#ParsedReport #CompletenessHigh
15-09-2026

An emerging Silver Fox-like cluster: PAPERMILL

https://www.jumpsec.com/guides/an-emerging-silver-fox-like-cluster-papermill/

Report completeness: High

Actors/Campaigns:
Silver_fox (motivation: financially_motivated)
Papermill (motivation: financially_motivated)
Dragonreturn

Threats:
Motw_bypass_technique
Donut
Asyncrat
Quasar_rat
Venomrat
Hvnc_tool
Xworm_rat
Dcrat
Dll_sideloading_technique
Valleyrat
Winos

Victims:
Indian tax entities

Industry:
Financial

Geo:
Indian, India, Chinese, China

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1027, T1036, T1106, T1140, T1204.002, T1497, T1553.005, T1566, T1574.002, T1620, have more...

IOCs:
File: 13
IP: 7
Domain: 14
Email: 1
Url: 2
Hash: 12
Path: 1
Registry: 1

Soft:
NSIS installer, Windows Runtime

Algorithms:
zip, rc4, hmac, sha256, aes, sha1, aes-256, pbkdf2, prng

Win API:
DAT, GetCursorPos

Languages:
python

Platforms:
x64

Links:
https://github.com/volexity/donut-decryptor