Silver Fox, an advanced persistent threat (APT) group based in China, has been active since its emergence in 2022, with significant operations documented through 2024. The group's tactics, techniques, and procedures (TTPs) notably include SEO poisoning to direct users to malicious domains masquerading as legitimate applications, such as Microsoft Teams. This campaign was partially uncovered through an exposed link management panel that is believed to facilitate the tracking of download activity for backdoor installer applications.