Silver Fox: China places 63 malware suspects under criminal compulsory measures
China's Ministry of Public Security says it has put 63 people under criminal compulsory measures in five malware cases. Security vendors track Silver Fox as a threat actor that deploys ValleyRAT, but the ministry's announcement does not establish that the suspects belonged to that group. No charges, trials or sentences have been reported. Part 2 of the Hackers vs the state series asks whether Beijing is punishing the crime or the victim list.
Listen to this briefing
Silver Fox: China places 63 malware suspects under criminal compulsory measures.
China's Ministry of Public Security says it has put 63 people under criminal compulsory measures in five malware cases. Security vendors track Silver Fox as a threat actor that deploys ValleyRAT, but the ministry's announcement does not establish that the suspects belonged to that group. No charges, trials or sentences have been reported. Part 2 of the Hackers vs the state series asks whether Beijing is punishing the crime or the victim list.
China's Ministry of Public Security (MPS) says it has put 63 people under criminal compulsory measures, a category that covers detention and arrest, in five malware cases. Security vendors track Silver Fox as a threat actor that deploys ValleyRAT; the ministry's announcement does not establish that any suspect belonged to that group. It has not said that any of them has been charged, tried or sentenced, and no public record of that turned up in research for this piece.
What the ministry says it did
The announcement came on 16 June, when the ministry published five "typical cases" (seen here only through a republication of the MPS release). The largest, in Jilin, involved 27 people accused of developing variants of the trojan and phishing companies, with alleged proceeds above 7 million yuan. In Shandong, 15 people were held over phishing sites that bundled the malware into software installers. Guangdong accounted for 13, Hangzhou for five, who allegedly made and sold the trojan, and Jiaxing for three. Those figures add up to 63. Risky Bulletin reported 67, a gap the sources do not explain, so this piece uses the ministry's count.
The ministry described the five cases as involving a trojan it calls Silver Fox. Security vendors also use Silver Fox as the name of a threat actor. ReliaQuest says that actor deploys ValleyRAT, a remote access trojan that gives an attacker control of a victim's computer; Winos is another name used for the malware. The MPS's allegations that people developed, sold or distributed the trojan do not establish that they belonged to the vendor-tracked group. The malware reaches victims through fake download sites, search engine poisoning and phishing emails, and has targeted finance staff at companies and public bodies. In November 2025 the ministry said trojans of this type had hit more than 1,000 firms and institutions, with losses above 2 billion yuan (as reported by IT Home, a secondary outlet).
The Shandong case also shows the state's reach. According to the MPS, as carried by Xinhua, the ringleader fled abroad in August 2025. Vietnamese police arrested him on 4 June 2026 and he was escorted back to China two days later, with the Chinese embassy's help. The parallel with Russia's arrests of VasyGrek suspects, covered in Part 1, is that both police actions concerned alleged cybercrime whose victims were at home.
Criminal gang or state asset?
The legal basis is Article 285 of the Criminal Law, which covers illegal control of computer systems. Cases it describes as especially serious carry three to seven years, and supplying intrusion tools is punished the same way. The Shandong case was labelled sabotage of computer information systems, a separate offence under Article 286.
Security vendors disagree about what Silver Fox is. QiAnXin, a Chinese firm, called it one of the most active and aggressive cybercrime groups in China, financially motivated. ReliaQuest assessed with high confidence that it runs both state-sponsored espionage and fraud, and Check Point classes it as an advanced persistent threat. Sekoia, as summarised by VPN Central, says its newest campaigns look more like profit-driven crime than espionage. Most reported victims are Chinese speakers, though vendors also place it in Taiwan, Japan and Malaysia.
One vendor also reported false clues in the malware, including Russian-language elements, apparently planted to mislead investigators. Whoever is behind it, the operators care about attribution, and that is a reason to treat any single label with caution.
Both readings can be true at once. A crew can sell its malware to anyone, steal from whoever pays off, and still have a customer in an intelligence service. The arrests do not settle that: the ministry's allegations that suspects developed, sold or distributed the malware are not evidence that they belonged to the vendor-tracked Silver Fox group, or of who, if anyone, sat above it.
The contrast the arrests invite
The same ministry appears in a very different role in a US indictment. On 5 March 2025 the US Department of Justice charged 12 Chinese nationals, among them two MPS officers and eight employees of the hacking firm i-Soon. Prosecutors alleged that i-Soon sold stolen data to at least 43 bureaus of the MPS and the Ministry of State Security, charging between $10,000 and $75,000 for each hacked email inbox. China's foreign ministry called the accusation groundless. These are allegations, untested in court.
Taken together, the two cases sketch a pattern, offered here as a hypothesis rather than a finding. Hackers who steal from Chinese firms for private gain are arrested and publicised. Hackers who allegedly steal from foreign targets for the state are, according to the US, paid.
The strongest counter-reading
That pattern may be too cynical. Every state with a fraud problem arrests fraudsters, and 2 billion yuan of losses at Chinese firms is reason enough for the ministry to act without any political calculation. The arrested gangs sit at the commercial end of the trade, which is where policing usually starts. The state links come from vendors whose attribution rests on infrastructure overlaps, and who also sell protection. Nor does the lack of sentences prove leniency: the case announcements are only five months old, and Chinese courts do not always publicise outcomes. The ministry also has its own interest in showing the public that it is acting, so an announcement is evidence of intent more than of results.
What would settle it
The arrests show that China is willing to chase a Silver Fox fugitive across a border and to say so in public. They do not show whether the state is punishing the crime or the victim list. The test is what follows: whether the suspects receive sentences, whether the Jilin case widens beyond the gang that has been named, and whether anyone who sold access to foreign inboxes ever finds themselves in the same dock as those who sold it to Chinese firms. Until sentences appear, the 63 are a count of suspects, and the answer is still open.
Sources: Ministry of Public Security, via 10jqka (republication, secondary); Xinhua; IT Home (secondary summary of MPS notice); Risky Bulletin; China Daily (Chinese edition); The Hacker News (reporting QiAnXin's assessment); ReliaQuest; Check Point Research; Sekoia, as summarised by VPN Central (secondary); The Record (US DOJ indictment); Xinhua via China Daily, on the foreign ministry's response.
Enable JavaScript and use a browser with spoken audio support to listen.
Read aloud by your browser. Voice and availability depend on your device.
Suspects under criminal compulsory measures in five malware cases announced by the Ministry of Public Security on 16 June 2026. The cases involved over ¥7 million in Jilin, over ¥3 million in Shandong, over ¥200,000 in Guangdong, over ¥3 million in Hangzhou and over ¥200,000 in Jiaxing. These are sums the ministry says the cases involve, not proven losses.
China’s Ministry of Public Security (MPS) says it has put 63 people under criminal compulsory measures, a category that covers detention and arrest, in five malware cases. Security vendors track Silver Fox as a threat actor that deploys ValleyRAT; the ministry’s announcement does not establish that any suspect belonged to that group. It has not said that any of them has been charged, tried or sentenced, and no public record of that turned up in research for this piece.
What the ministry says it did
The announcement came on 16 June, when the ministry published five “typical cases” (seen here only through a republication of the MPS release). The largest, in Jilin, involved 27 people accused of developing variants of the trojan and phishing companies, with alleged proceeds above 7 million yuan. In Shandong, 15 people were held over phishing sites that bundled the malware into software installers. Guangdong accounted for 13, Hangzhou for five, who allegedly made and sold the trojan, and Jiaxing for three. Those figures add up to 63. Risky Bulletin reported 67, a gap the sources do not explain, so this piece uses the ministry’s count.
The ministry described the five cases as involving a trojan it calls Silver Fox. Security vendors also use Silver Fox as the name of a threat actor. ReliaQuest says that actor deploys ValleyRAT, a remote access trojan that gives an attacker control of a victim’s computer; Winos is another name used for the malware. The MPS’s allegations that people developed, sold or distributed the trojan do not establish that they belonged to the vendor-tracked group. The malware reaches victims through fake download sites, search engine poisoning and phishing emails, and has targeted finance staff at companies and public bodies. In November 2025 the ministry said trojans of this type had hit more than 1,000 firms and institutions, with losses above 2 billion yuan (as reported by IT Home, a secondary outlet).
The Shandong case also shows the state’s reach. According to the MPS, as carried by Xinhua, the ringleader fled abroad in August 2025. Vietnamese police arrested him on 4 June 2026 and he was escorted back to China two days later, with the Chinese embassy’s help. The parallel with Russia’s arrests of VasyGrek suspects, covered in Part 1, is that both police actions concerned alleged cybercrime whose victims were at home.
Subscribe
New essays and snapshots, by email, roughly weekly.
Criminal gang or state asset?
The legal basis is Article 285 of the Criminal Law, which covers illegal control of computer systems. Cases it describes as especially serious carry three to seven years, and supplying intrusion tools is punished the same way. The Shandong case was labelled sabotage of computer information systems, a separate offence under Article 286.
Security vendors disagree about what Silver Fox is. QiAnXin, a Chinese firm, called it one of the most active and aggressive cybercrime groups in China, financially motivated. ReliaQuest assessed with high confidence that it runs both state-sponsored espionage and fraud, and Check Point classes it as an advanced persistent threat. Sekoia, as summarised by VPN Central, says its newest campaigns look more like profit-driven crime than espionage. Most reported victims are Chinese speakers, though vendors also place it in Taiwan, Japan and Malaysia.
One vendor also reported false clues in the malware, including Russian-language elements, apparently planted to mislead investigators. Whoever is behind it, the operators care about attribution, and that is a reason to treat any single label with caution.
Both readings can be true at once. A crew can sell its malware to anyone, steal from whoever pays off, and still have a customer in an intelligence service. The arrests do not settle that: the ministry’s allegations that suspects developed, sold or distributed the malware are not evidence that they belonged to the vendor-tracked Silver Fox group, or of who, if anyone, sat above it.
The contrast the arrests invite
The same ministry appears in a very different role in a US indictment. On 5 March 2025 the US Department of Justice charged 12 Chinese nationals, among them two MPS officers and eight employees of the hacking firm i-Soon. Prosecutors alleged that i-Soon sold stolen data to at least 43 bureaus of the MPS and the Ministry of State Security, charging between $10,000 and $75,000 for each hacked email inbox. China’s foreign ministry called the accusation groundless. These are allegations, untested in court.
Taken together, the two cases sketch a pattern, offered here as a hypothesis rather than a finding. Hackers who steal from Chinese firms for private gain are arrested and publicised. Hackers who allegedly steal from foreign targets for the state are, according to the US, paid.
The strongest counter-reading
That pattern may be too cynical. Every state with a fraud problem arrests fraudsters, and 2 billion yuan of losses at Chinese firms is reason enough for the ministry to act without any political calculation. The arrested gangs sit at the commercial end of the trade, which is where policing usually starts. The state links come from vendors whose attribution rests on infrastructure overlaps, and who also sell protection. Nor does the lack of sentences prove leniency: the case announcements are only five months old, and Chinese courts do not always publicise outcomes. The ministry also has its own interest in showing the public that it is acting, so an announcement is evidence of intent more than of results.
What would settle it
The arrests show that China is willing to chase a Silver Fox fugitive across a border and to say so in public. They do not show whether the state is punishing the crime or the victim list. The test is what follows: whether the suspects receive sentences, whether the Jilin case widens beyond the gang that has been named, and whether anyone who sold access to foreign inboxes ever finds themselves in the same dock as those who sold it to Chinese firms. Until sentences appear, the 63 are a count of suspects, and the answer is still open.
Sources: Ministry of Public Security, via 10jqka (republication, secondary); Xinhua; IT Home (secondary summary of MPS notice); Risky Bulletin; China Daily (Chinese edition); The Hacker News (reporting QiAnXin’s assessment); ReliaQuest; Check Point Research; Sekoia, as summarised by VPN Central (secondary); The Record (US DOJ indictment); Xinhua via China Daily, on the foreign ministry’s response.
