Since the end of the Spring Festival holiday, Weibu Intelligence Bureau has detected a full-scale resurgence of SilverHawk attack activities. In March, the silver fox returned to its activity level a year ago. The number of new variants captured by the micro-step intelligence agency reached 500 throughout the month. It was found that a large number of attack methods, which have been iterated several times since the second half of last year, have exceeded the highest level of last year. Iterative techniques include:

Technique 1, a large number of counterfeit electronic tax platforms, false pop-up windows:

Attackers use hundreds of shell companies to register phishing domain names, which can quickly change the domain names of phishing websites to prevent interception. These websites mainly counterfeit electronic tax platform, through the "system version is too low" false pop-up window, induce users to download the silver fox Trojan.

Manipulation 2, user state blinding EDR, interference detection:

Compared with the homologous sample disclosed by micro-step in September last year, the attacker gave up loading the local binfile in white and black in March this year, but downloaded the shellcode from the remote server and used Unhooking technology to blind EDR in the user state. At present, the number of the latest variants of this batch of samples is close to 200, and C2 is more than 20, which is the most popular sample in the fishing list of finance, taxation and discipline violations.

Technique 3, write the driver by yourself, directly shut down and kill the soft EDR:

In October last year, microstep captured a batch of silver fox samples with multi-Rootkit blessing. In March this year, the latest sample of attackers stopped relying on existing drivers and began to write their own drivers, bypassing Microsoft blacklist interception, and could shut down 11 kinds of software killing and EDR processes such as 360, Firewool, Tencent Computer Manager and Jinshan Poison Bulls. Taken together, this batch of samples has the highest adversarial complexity.

According to the "Black Production" Silver Fox "2025 Annual Prevention and Control Report released by Microstep, 93.19 percent of the enterprises attacked by the group had no perception of the attack before the black production group was pulled, which is sufficient to prove that continuous iterative confrontation can easily bypass the existing protection system and requires users to attach great importance to it.

At present, the micro-step terminal security management platform OneSEC, cloud sandbox S, sandbox analysis platform OneSandbox have supported the accurate detection of all samples.