Silver Fox Targets Japanese Manufacturer with Novel BYOVD Chain and ValleyRAT
The Silver Fox threat group has deployed a sophisticated attack chain against a Japanese manufacturer, leveraging new vulnerable drivers and legitimate tools to install the ValleyRAT backdoor for persistent industrial system access.
The Chinese cybercrime group known as Silver Fox has been observed employing a novel bring your own vulnerable driver (BYOVD) attack chain against a Japanese organization within the industrial manufacturing sector. The ultimate goal of this campaign is to deploy the ValleyRAT malware, a variant of Gh0st RAT, to establish persistent remote access to the victim's critical systems.
Researchers at Cato Networks detailed the intricate attack sequence, noting that the group combines newly observed vulnerable driver abuse, legitimate application DLL sideloading, advanced defense evasion techniques, and layered recovery mechanisms to ensure ValleyRAT's continued operation. The initial entry point is a phishing lure disguised as an invoice, which directs victims to attacker-controlled content hosted on legitimate QQ and Tencent Cloud services. This lure initiates a DLL sideloading chain via a ZIP archive, paving the way for ValleyRAT's deployment.
Before deploying the final payload, the attackers leverage the BYOVD technique to gain kernel-level access. This allows them to disable or impair security controls on the compromised host, significantly reducing the chances of detection. The ZIP archive contains a downloader executable that fetches subsequent components from an attacker-controlled Tencent Cloud infrastructure, essential for the DLL sideloading process.
While Silver Fox has previously utilized vulnerable drivers like "amsdk.sys" and "wsftprm.sys," this latest campaign introduces two new drivers: "BootRepair.sys" and "EnPortv.sys." These drivers have not been publicly associated with prior Silver Fox attacks. The malicious DLL, "PDFCORE8.dll," is sideloaded by legitimate binaries like "ConvertToPDF.exe" or "PDFDirect.exe" (both associated with Zeon Corporation) and embeds these three drivers, creating a modular three-driver BYOVD framework for enhanced defense evasion.
The incorporation of multiple drivers provides operational resilience, allowing attackers to swap them out and maintain the overall workflow. This modularity extends to other aspects of the attack. The malware also employs NTDLL unhooking to remove inline hooks placed by endpoint security software on native Windows API activity, further obscuring its actions.
The DLL loader acts as a self-contained execution framework and is responsible for launching a watchdog batch script. This script ensures persistence through a scheduled task and communicates with a command-and-control server at "43.128.26[.]132" to download shellcode. This shellcode is then injected into a new "svchost.exe" process using thread-context hijacking.
A key feature of this campaign is its dual watchdog design, ensuring execution recovery. An internal routine monitors the injected payload, while an external watchdog script monitors the loader responsible for the payload. This layered approach means defenders must disable both components to fully neutralize the intrusion, as one can restore the other. This resilience reinforces the modular design, where driver deployment, security process termination, injection, and payload monitoring are coordinated components.
The disclosure of this campaign highlights Silver Fox's continuous refinement of its toolset, which includes other malware like Atlas RAT and RomulusLoader. The group also continues to use tax-themed lures for delivering Gh0st RAT and DCRat, indicating an active and evolving threat.