Anatomy of the One Fox Toolkit

Introduction

#

When EclecticIQ analyzed a 2023 Cobalt Strike intrusion¹ at Taiwan’s Directorate General of Highways (MOTC), the most useful artifact wasn’t the malware. It was a filesystem path leaked in the C2 logs:

C:\Users\Test\Desktop\ONE-FOX集成工具箱_V1.0魔改版_by狐狸\gui_other\Cobalt_Strike_4.5\plugin\TaoWu\script\lazagne.exe

One string, six facts: which toolkit version was being run, who modded it (“by 狐狸”, meaning Fox), what was bundled inside, which plugin pack was loaded, which credential-dumper was being pushed to the victim (LaZagne), and that the operator was running the whole thing from a desktop user account literally named Test.

The toolkit is from a Chinese red-team collective called the One Fox Security Team (一只狐狸安全团队). Their GitHub repo² (about 1.5k stars, MIT-licensed) is almost empty: a README, a LICENSE, a single PNG. The actual distributables live on Baidu Pan and Quark Pan, with the passwords printed right in the README; the group’s WeChat OA 狐狸说安全 (“Fox Says Security”) carries release announcements and one auth-code-gated holiday edition. GitHub is the billboard; the cloud drives are the warehouse. The bundle in the Taiwan logs is the 2022 ONE-FOX 集成工具箱 V1.0; the 天狐 Community Edition described below is its 2025 successor.

What’s actually in the kit

#

The flagship is the 天狐渗透工具箱-社区版 (“Heavenly Fox” Community Edition penetration toolkit), currently at V3.0³ (January 2026). It’s a Python GUI launcher that chains and orchestrates a curated set of mostly-public tools. By the group’s own taxonomy (roughly 200 tools in ten folders), the entries visible in the README screenshots² read like a who’s-who of Chinese red-team tooling:

• WebShell management: Godzilla (哥斯拉), Behinder (冰蝎) 3 and 4, 天蝎.
• Vulnerability scanning and exploitation: Fscan, DDDD, TscanPlus, SQLMAP X Plus, IWannaGetAll, plus a separate folder of 13 framework-exploit tools.
• Recon and proxying: DirSearch, WebPack info-gathering, BurpSuite Pro, Yakit.
• Evasion: FoxBypass V1.0, a “separated AV-evasion loader” (split-payload pattern).
• Post-exploitation: a “美化破解版” (prettified cracked) Cobalt Strike 4.7, plus CACM for Linux post-ex and persistence.
• Blue-team: an Emergency Response Toolkit. The same group ships both halves of the engagement.

Where the kit sits

#

One Fox is not a KnownSec or i-Soon. Those were involuntary contractor leaks: state-aligned tradecraft, target lists, and in-house implants. One Fox is voluntary, open publication by an HVV-oriented red team. The V1.2 release ships with the tagline⁴ “助力HVV季”: supporting HVV season, China’s coordinated state-and-enterprise red/blue exercises.

NetAskari, who reviewed a Chinese pen-tester’s kit⁵ that included a full copy of the One Fox 天狐 V2.0 toolbox, was careful about what the artifacts did and didn’t reveal:

we have no evidence or signs to assume that the person is working for the Chinese state or is affiliated in any way in APT activity

A normal pen-tester’s kit, and you can find similar ones everywhere.

That’s the calibration. The KnownSec leak shows what gets built at the top of the Chinese offensive pyramid: RATs, target libraries and alleged data-theft logs aimed mostly at China’s Asian neighbours. The One Fox repo shows what gets handed out at the bottom: the commodity, community-tier layer that feeds upward into contractor work and HVV competition teams. The Taiwan incident is what happens when something from that bottom layer ends up on a desktop pointed at real critical infrastructure: a CCTV-access compromise at 08:51:43 UTC on February 9, 2023, launched from C:\Users\Test\Desktop\.