Behind the fake AnyDesk: Tracking a Silver Fox-Linked ValleyRAT Campaign

Report summary

This research examines a ValleyRAT distribution campaign delivered through a fake AnyDesk website targeting Chinese-speaking users. What began as a single SEO-poisoned software lure expanded into a broader ecosystem of impersonated VPN, proxy, messaging, and administrative tools, all designed to push trojanized installers through trusted-looking download flows. Atos TRC attributes this campaign to Silver Fox / TA4922 based on the use of ValleyRAT, overlapping infrastructure, and tradecraft consistent with the group’s historical activity. Recent arrests reported by Chinese media complicate the picture: while some operators may have been disrupted, Silver Fox campaigns using familiar TTPs continued to appear only weeks after the law-enforcement action.

Read the full research here.