An East China’s Shandong-based task force, operating under the Ministry of Public Security's (MPS) unified command and with backing from the Chinese Embassy in Vietnam and Vietnamese police, has successfully taken custody of Pan, the alleged ringleader behind a computer information systems sabotage case, and escorted him back to China.

According to a statement released by the MPS, police in Shandong’s Zibo found in July 2025 that a local netizen surnamed Yang set up and operated multiple phishing websites luring internet users into downloading software bundled with the “Silver Fox” Trojan. The malware was used to take control of victims’ computers, steal user data and obtain illegal profits.

Between July 2025 and May 2026, the public security authorities dismantled multiple criminal groups tied to the case; meanwhile, the lead suspect, surnamed Pan, fled abroad in August 2025 and remained hidden until his recent apprehension.

Following persistent efforts by Chinese public security authorities, Vietnamese police apprehended Pan with the support of the Chinese Embassy in Vietnam on June 4 this year. Simultaneous police raids in Guangdong and Guangxi and other regions led to the arrest of the remaining 11 suspects in a single sweep. Pan was escorted back to China on June 6.

On June 16, the MPS released five typical cases involving the crackdown on the “Silver Fox” Trojan. It said that the malware is highly concealed and targets enterprise and institutional employees, especially finance staff, to launch cyberattacks. It can remotely control computers, steal credentials, intercept verification codes, and obtain private data, Xinhua News Agency reported, citing the cybersecurity bureau of the MPS.

According to the National Computer Virus Emergency Response Center, the “Silver Fox” Trojan is a remote-control malware that has been active for many years and primarily targets internet users in China. From the beginning of its development, the malware was designed with the clear purpose of generating illegal profits. The malware family has evolved into a full cybercrime ecosystem and continues to be updated.

In recent years, the “Silver Fox” Trojan has undergone continuous updates and iterations, hiding in everyday digital environments such as office systems, messaging platforms, and email networks to launch attacks.

In the five typical cases released by the cybersecurity bureau of the MPS on June 16, the cybersecurity departments of public security authorities in localities had solved a series of cybercrime cases involving the “Silver Fox” Trojan malware, arresting a total of 63 suspects.

According to the MPS, the criminal group led by Yang used phishing websites to spread the “Silver Fox” Trojan, illegally control computers, and steal online assets worth more than 3 million yuan (about $443,019).

According to the MPS, the capture and repatriation of Pan highlight Chinese public security authorities’ firm determination to combat crime and pursue fugitives. The authorities said that they will continue to enhance international law enforcement cooperation, crack down on cybercrime, and safeguard the lives and property of the public.