Silver Fox Takedown Cuts China Controlled Endpoints by About 55 Percent

A 23 September 2026 Beijing review meeting of the China Internet Cybersecurity Threat Governance Alliance reported stage results from a Silver Fox malware campaign that began on 29 July. Members have catalogued more than 24,000 indicators, disposed of 2,588 control IP and port pairs and 8,587 control domains, and recorded about a 55 percent drop in domestic controlled endpoints.

Meeting and campaign

On 23 September 2026, the China Internet Cybersecurity Threat Governance Alliance held a stage review meeting in Beijing on a special campaign against Silver Fox malware. Member organizations of the special action working group attended. The meeting reviewed earlier results, exchanged technical practice, and discussed next-stage tasks.

Silver Fox mainly spreads through fake software download sites, phishing email, and instant messaging. After it infects a user endpoint, it performs remote control and information theft and supports downstream cyber fraud. To address the threat, the alliance launched a special campaign on 29 July, opened public collection of threat clues, and pooled monitoring, analysis, and coordinated takedown.

Results

Since the campaign began, members have shared indicators, jointly assessed activity, and acted against malicious control servers and related domains. The group has built a workflow covering intelligence reporting, joint analysis, coordinated disposal, and result feedback.

The special intelligence library now holds more than 24,000 threat indicators. Operators have disposed of 2,588 control-end IP addresses and ports and 8,587 control domains. Monitoring shows the number of domestic controlled endpoints has fallen by about 55 percent from earlier levels.

While continuing to take down malicious network resources, the working group has tracked key groups and mapped links among fake sites, malware samples, and control infrastructure. That mapping supports identification of spread channels, checks of infected endpoints, and targeted disposal. The working group has also published key control-end and related domain information through CNCERT and the alliance website so the public can check risk.

Member work and next steps

At the meeting, the Internet Domain Name System National Engineering Research Center (ZDNS), Antiy Labs, Topsec, and ThreatBook described work on fake-site monitoring, group activity analysis, threat intelligence assessment, and malicious domain resolution blocking. Participants discussed intelligence quality, deeper technical cooperation, more precise disposal, and better outcome evaluation.

The meeting called for continued intelligence and specialist support, analysis of key groups' methods and activity patterns, and timely discovery, verification, and disposal of new attack resources. It also called for post-disposal follow-up, tighter links between outcome evaluation and supplemental analysis, threat intelligence sharing, risk notices, and public query services so analysis can be turned into endpoint and network defenses.

The alliance will keep organizing coordinated governance among members and will continue to collect threat clues from the public. Organizations and internet users may send suspected sites, malicious download links, samples, and other clues to silverfox@cert.org.cn. Users are advised to download software from official sites or trusted app stores, verify URLs, treat unknown links and attachments with caution, and keep security software updated.