CNCERT: Silver Fox Jia Yi (G01) group controls 8,708 hosts in China

CNCERT and Topsec reported that the Jia Yi (G01) Silver Fox group controlled 8,708 hosts in China between 15 and 22 September 2026, with a one-day peak of 2,361. Analysts verified 1,060 fake download domains and two active C2 addresses aimed at users of FinalShell, NexusDesk, and similar operations tools.

Joint CNCERT and Topsec findings

CNCERT and Topsec Technology Group Co., Ltd. jointly reported on the Jia Yi (G01) group in the Silver Fox malware program. The group used search-engine SEO poisoning and paid-keyword ads, together with AI-cloned software download sites, to spread Silver Fox. From 15 to 22 September 2026, CNCERT counted 8,708 compromised hosts in China under the group's control, with a single-day online peak of 2,361. The activity threatens individuals and enterprises that use development and operations tools. Those users often hold high-value host privileges. A compromised endpoint can support further movement inside a network.

The working group verified 1,060 impersonation domains, a one-day registration peak of 110, and two active command-and-control (C2) addresses.

Group profile

Name: Jia Yi (G01)

Earliest domain in the current set: 9 July 2026

Status: Active. Domain registration continued through 9 September 2026.

Targets: Users of FinalShell, NexusDesk, Xshell, SecureCRT, and similar operations tools, plus messaging tools such as SafeW. Operators and developers are treated as high-value targets.

Distribution: SEO poisoning and keyword ads; AI-cloned fake download sites; redirects into cloud object storage.

Observed impact on infected hosts includes multi-stage loading, DLL sideloading with a signed host program, process injection, Windows Defender exclusion writes, scheduled-task persistence, hosts-file changes that block security-vendor sites, and remote control with two-way data exchange.

Domains and hosting

Of 1,060 domains, 1,042 used .com.cn (98.3 percent) and 18 used .cn. Name templates reused prefixes an- (298), app- (205), ah- (203), ai- (33), and am- (24), more than 70 percent of the set combined. Patterns were letter-prefix plus brand plus .com.cn, and brand plus function plus .com.cn, with repeated letters, missing letters, and misspellings. Terms were one year. The peak registration day added 110 names.

Most names resolved to Cogent nodes in Hong Kong, with many fake domains on one IP. Four object-storage buckets held malware, mainly Alibaba Cloud OSS in Beijing, Hangzhou, and Hong Kong. A relay domain download.hzx[.]me sat in the path. Repeated downloads of the same file name returned different hashes, which indicates per-request packing.

C2 addresses: 14.128.53[.]194:80 (linked to xwizard.exe) and 47.243.152[.]51:18300 (linked to VBV4HZ.exe).

Other infrastructure: a forged digital signature in the name of Bytedance Pte. Ltd.; abuse of a valid Speech Processing Solutions GmbH signature for sideloading; 51.LA analytics IDs used to score each fake brand.

WHOIS records paired real citizen names and national ID numbers with overseas free-mail control accounts. One mailbox mapped to several registrant names in rotation, which indicates borrowed identities.

Fake download sites

Queries such as FinalShell download led to ssh-finalshell.com[.]cn and related names, including apps-finalshell.com[.]cn, www.ch-finalshell.com[.]cn, and web-finalshell.com[.]cn. Earlier waves impersonated Chrome, WPS, and Telegram. FinalShell is a common SSH and SFTP client, so victims often have privileged access.

Fake pages shared a standardised front end and did not match official copy line for line. Analysts assess that AI crawled vendor sites and cloned them in bulk. Operators preferred .com.cn, which requires strong real-name registration, and used name and ID combinations from prior data leaks.

The path was search result, fake domain, cloud object storage, then malware. Redirects added extra hops.

Same-named archives (instell_s2.0.0x.zip) produced different MD5 values across fetches, including cb03bffe8eb990a4071cb9c82dff8c94, 21a495caeba6efdcd16e54ce7ce26e41, ea2eaf5b853fd93b4771f641c98639d8, 6ac53bdfa55e9e417b2688804658664d, and 95cfcfa1a4bbf679faea0a5abff8e6ac. FinalShell and NexusDesk fake sites also served identically named packages.

Sample indicators and impact

Packages contained a 35,473,200-byte Windows 64-bit executable presented as an installer. An embedded Bytedance Pte. Ltd. signature failed digest verification. After a user runs the file, later stages persist and open a remote-control channel to overseas C2. The first-stage file is a loader. It does not itself steal data.

Published sample: file name instell_s2.0.03.exe, SHA-256 285b3bc94b18ac314c6a4e9d2fc39383a46a459b5e5db8d627dd8b8db6b79743, MD5 3478c09e3c39ebaba0a8c7872aad3653, type PE32+.

Configuration and resources sat on Alibaba Cloud OSS and can be replaced without moving C2. VBV4HZ.exe exchanged data with 47.243.152[.]51:18300.

Users should obtain FinalShell, NexusDesk, Xshell, SecureCRT, and SafeW only from vendor sites, ignore sponsored search download results, and block the published domains and C2 addresses. On suspected hosts, check Windows Defender exclusion lists, unexpected scheduled tasks, and hosts-file redirects for 360 security sites.