{"id":8136,"date":"2026-03-27T12:00:00","date_gmt":"2026-03-27T10:00:00","guid":{"rendered":"https:\/\/blog.eset.ee\/et\/2026\/03\/27\/a-cunning-predator-how-silver-fox-preys-on-japanese-firms-this-tax-season\/"},"modified":"2026-03-27T12:00:00","modified_gmt":"2026-03-27T10:00:00","slug":"a-cunning-predator-how-silver-fox-preys-on-japanese-firms-this-tax-season","status":"publish","type":"post","link":"https:\/\/blog.eset.ee\/et\/en\/2026\/03\/27\/a-cunning-predator-how-silver-fox-preys-on-japanese-firms-this-tax-season\/","title":{"rendered":"A cunning predator: How Silver Fox preys on Japanese firms this tax season"},"content":{"rendered":"

Japan has entered its annual tax filing and organizational change season, a period when companies generate a high volume of legitimate financial and HR\u2011related communications. A threat actor known as Silver Fox is actively exploiting this busy period by conducting a targeted spearphishing campaign against Japanese manufacturers and other businesses.<\/p>\n

The ongoing campaign uses convincing phishing lures related to tax compliance violations, salary adjustments, job position changes, and employee stock ownership plans. All emails share the same goal \u2013 trick the recipients into opening malicious links or attachments. As employees actually expect to receive emails about these subjects this time of year, they\u2019re more likely to trust and act on such messages without a second thought. Needless to say, this significantly increases the risk of compromise.<\/p>\n

The operation is also a reminder for organizations to increase vigilance, reinforce awareness around phishing attempts, and ensure that employees verify the authenticity of tax\u2011 and HR\u2011themed requests \u2013 including those that look routine. Immediate reporting of suspicious emails to security teams is essential to reduce exposure and prevent successful compromise.<\/p>\n

What is the threat?<\/h2>\n

Active since at least 2023<\/a>, Silver Fox initially focused on Chinese-speaking targets<\/a> before expanding into Southeast Asia, Japan<\/a>, and potentially North America<\/a>, running each campaign in a local language. This broadened scope shows in the range of verticals the group has hit over the years \u2013 finance<\/a>, healthcare<\/a>, education<\/a>, gaming<\/a>, government<\/a> and even cybersecurity<\/em><\/a>. The group also primarily operates in Southeast Asia and has a well-documented<\/a>
\nhistory<\/a> of finance-themed<\/a> spearphishing campaigns during seasonal business cycles.<\/p>\n

In the ongoing campaign, the group is taking advantage of Japan\u2019s annual cycle of tax filing, financial reporting, salary adjustments, and personnel changes. This pattern isn\u2019t new \u2013 similar activity was observed during the same period last year, indicating that Silver Fox deliberately aligns its operations with this season. The volume and urgency of legitimate internal communication around these topics is high this time of year, which is exactly what Silver Fox is counting on and what makes its campaigns effective.<\/p>\n

In this operation, Silver Fox sends tailored spearphishing emails crafted to look like legitimate HR or tax-related messages. To make the emails appear authentic, the attackers often include the name of the targeted company directly in the subject line. Examples of subjects observed in this campaign include:<\/p>\n