Silver Fox, a China-based intrusion set active since early 2022, has notably transitioned from primarily financially motivated attacks to a dual strategy involving both advanced persistent threat (APT) operations and traditional cybercrime. This evolution reflects a broader trend observed in 2025, where the distinctions between financially driven cybercrime and state-sponsored espionage have become increasingly ambiguous.