New Silver Fox Campaign Hits Japanese Businesses With Tax-Themed Phishing Lures

A threat actor known as Silver Fox is actively targeting Japanese businesses with highly tailored spearphishing emails designed to exploit the country’s tax season. 

The campaign leverages routine corporate communications related to tax filings, salary adjustments, and personnel changes to trick employees into downloading malware.

Once executed, the attack deploys ValleyRAT, a remote access trojan that gives attackers full control of compromised systems.

---

Seasonal Timing Increases Success Rate

The campaign is carefully timed to coincide with Japan’s annual period of:

• Tax filing activities
• Salary reviews
• HR updates
• Employee stock plan changes
• Personnel announcements

Because employees expect such communications, malicious emails appear legitimate and trustworthy.

This seasonal targeting significantly increases the likelihood of successful compromise.

---

Highly Targeted Spearphishing

Unlike generic phishing campaigns, Silver Fox conducts reconnaissance before sending emails.

Researchers observed that attackers:

• Use real employee names
• Spoof CEO identities
• Include company names in subject lines
• Tailor messages to each organization
• Write emails in the local language

This level of personalization makes detection much harder.

---

Common Phishing Lures

Subject lines observed in the campaign include references to:

• Tax compliance violations
• Salary adjustments
• Personnel updates
• HR notifications
• Employee stock ownership changes

These topics align with legitimate internal communications.

---

Malware Payload: ValleyRAT

Opening malicious attachments or downloads results in the deployment of ValleyRAT, a remote access trojan detected as Win64/Valley.

Once installed, ValleyRAT enables attackers to:

• Remotely control the system
• Steal sensitive data
• Monitor user activity
• Maintain persistence
• Move laterally within the network

This allows long-term access to corporate environments.

---

Infection Chain

The attack typically follows a straightforward sequence:

1. Victim receives targeted phishing email
2. Email contains attachment or download link
3. File disguised as HR or salary document
4. Victim opens archive (RAR or ZIP)
5. ValleyRAT installs silently
6. Persistence mechanisms activated
7. Attacker gains remote access

Despite its simplicity, the targeted approach makes it effective.

---

Delivery Methods

Attackers often use legitimate file-hosting services, including:

• Public file-sharing platforms
• Cloud-based transfer services
• Archive files for payload packaging

Using familiar platforms helps avoid suspicion.

---

Defensive Recommendations

Organizations should implement the following protections:

• Verify HR-related emails through separate channels
• Check sender email addresses carefully
• Monitor for language inconsistencies
• Block suspicious file-sharing links
• Update endpoint security tools
• Report suspicious emails immediately

Security awareness is critical during seasonal campaigns.

---

Key Takeaways

• Silver Fox targeting Japanese businesses
• Campaign timed with tax season
• Highly personalized spearphishing emails
• ValleyRAT deployed for remote access
• Legitimate file-sharing platforms used
• Employees targeted with HR-themed lures

---

Conclusion

The Silver Fox campaign highlights how threat actors exploit predictable business cycles to increase phishing success. By combining seasonal timing, targeted reconnaissance, and remote access malware, attackers can gain long-term access to corporate networks. Organizations should strengthen email verification processes and educate employees to reduce the risk of compromise.