The China-linked cybercrime group Silver Fox has launched a sophisticated cyberattack targeting a Japanese industrial manufacturing company by introducing two previously unreported vulnerable drivers into its Bring Your Own Vulnerable Driver (BYOVD) attack framework. The campaign ultimately deploys ValleyRAT (also known as Winos 4.0), a powerful remote access trojan designed to maintain long-term access to compromised systems.
Security researchers at Cato Networks say the latest operation demonstrates a significant evolution in Silver Fox’s attack techniques by combining vulnerable drivers, DLL sideloading, stealth mechanisms, and multiple persistence layers to evade modern security solutions.
Phishing Email Starts the Infection Chain
The attack begins with an invoice-themed phishing email that tricks victims into downloading a malicious ZIP archive. Instead of hosting malware on suspicious domains, the attackers abuse trusted cloud services such as Tencent Cloud and QQ, making the campaign appear more legitimate.
Once opened, the ZIP archive executes a downloader that retrieves additional malware components from attacker-controlled infrastructure. These components initiate a DLL sideloading chain that eventually installs ValleyRAT on the victim’s computer.
New Vulnerable Drivers Added to BYOVD Framework
Silver Fox has previously abused vulnerable Windows drivers such as amsdk.sys and wsftprm.sys to disable security protections. However, researchers discovered that this campaign introduces two additional drivers that have not been publicly associated with the group before:
- BootRepair.sys
- EnPortv.sys
The malicious DLL, PDFCORE8.dll, is sideloaded through legitimate applications including ConvertToPDF.exe and PDFDirect.exe, both associated with Zeon Corporation.
Instead of relying on a single driver, the malware embeds all three vulnerable drivers, creating a modular BYOVD framework that allows attackers to switch between drivers depending on the target environment. This flexible architecture improves reliability and helps bypass security defenses even if one driver is blocked.
Advanced Defense Evasion Techniques
Beyond vulnerable driver abuse, Silver Fox employs several advanced techniques to remain undetected.
The malware performs NTDLL unhooking, removing user-mode hooks commonly placed by endpoint detection and response (EDR) solutions. This allows malicious activity to bypass monitoring of native Windows API calls.
Researchers also identified several additional defense evasion techniques, including:
- DLL sideloading
- Process injection
- Registry-based payload storage
- Security process termination
- Kernel-level privilege abuse through BYOVD
Together, these techniques significantly reduce the likelihood of detection during the attack.
ValleyRAT Provides Persistent Remote Access
After disabling security controls, the malware injects shellcode into a newly created svchost.exe process using a technique known as thread-context hijacking.
The final payload, ValleyRAT, is a variant of the well-known Gh0st RAT malware family. It enables attackers to:
- Establish encrypted command-and-control (C2) communication
- Execute remote commands
- Upload and download files
- Run additional malware
- Maintain long-term access to compromised systems
Dual Watchdog Mechanism Ensures Persistence
One of the most notable aspects of the campaign is its dual recovery mechanism designed to keep the malware running even if defenders remove part of the infection.
Silver Fox deploys two independent watchdog components:
- An internal monitoring routine continuously checks whether the injected ValleyRAT payload is active.
- A separate watchdog batch script monitors the malware loader through a scheduled Windows task.
If the RAT process is terminated, the loader automatically recreates it. Conversely, if the loader itself is removed, the watchdog script relaunches it.
This layered recovery system makes incident response considerably more difficult because defenders must eliminate every persistence component simultaneously to fully remove the infection.
Modular Malware Design Increases Flexibility
Researchers note that the campaign’s architecture is highly modular.
Instead of combining all malicious functionality into one executable, Silver Fox separates driver deployment, security bypass, payload injection, persistence, and recovery into individual modules. This allows operators to update or replace specific components without redesigning the entire attack chain.
Such modularity also enables the group to quickly adapt to new security products and changing defensive measures.
Silver Fox Continues to Expand Its Malware Arsenal
The discovery highlights Silver Fox’s continued investment in developing increasingly sophisticated malware.
Recent investigations have linked the group to several additional malware families, including:
- Atlas RAT (AtlasCross RAT)
- RomulusLoader
- SilentRunLoader
- Gh0st RAT
- DCRat
Security researchers also reported identifying 146 unique Atlas RAT samples during a six-month retrospective hunt across the VirusTotal malware repository. The large number of variants suggests the malware may be developed commercially or distributed privately rather than maintained by a single operator.
However, researchers caution that while Atlas RAT shares similarities with Silver Fox operations, there is currently insufficient evidence to definitively attribute its development to the same threat group.
Key Takeaways
Silver Fox continues to demonstrate a high level of technical sophistication by expanding its BYOVD toolkit with new vulnerable drivers while combining DLL sideloading, kernel-level privilege abuse, advanced process injection, and resilient persistence mechanisms.
The campaign serves as another reminder that organizations should not only keep systems patched but also actively monitor for the abuse of legitimate drivers and trusted applications. As threat actors increasingly adopt modular malware architectures, layered security controls and continuous threat hunting remain essential to detecting and disrupting these evolving attacks before they achieve persistent access.
