Silver Fox Nsis Installer Activity

nomit vyas@xoxo

•updated Feb 9, 2026•1•0•54

Detects the execution of an NSIS installer associated with the Silver Fox APT, which drops a legitimate executable (Thunder.exe) and a malicious DLL (libexpat.dll). This activity is the initial stage of the Silver Fox infection chain.