SilverFox Malware Evolves, Leverages Trusted Software and Kernel Drivers to Evade Detection

The SilverFox malware campaign has escalated its operations, recently targeting a Japanese industrial manufacturer with a multi-stage attack designed to bypass security defenses and establish persistent access. Researchers at CATO Networks identified the campaign, noting a high degree of confidence in attributing it to the SilverFox threat actor. The initial infection vector involved a deceptive phishing email containing a ZIP archive, purportedly a fake invoice, which led to the execution of the malware.

At the heart of the campaign's stealth is its sophisticated use of DLL sideloading. Attackers pair a legitimate, trusted PDF-related application with a malicious Dynamic Link Library (DLL) placed in the same directory. When the legitimate application is launched, Windows prioritizes loading the attacker-controlled DLL, allowing the malware to execute under the guise of a trusted process. This technique avoids modifying the original signed application, making detection more challenging and mimicking the behavior seen in other campaigns that abuse signed software.

Once the malicious loader is active, it proceeds to deploy signed but vulnerable kernel drivers. These drivers operate at a deep level within the Windows operating system, enabling the malware to terminate security processes such as antivirus and endpoint detection and response (EDR) tools. This capability is crucial for SilverFox, as it systematically dismantles defenses before deploying its final payload. The campaign has notably introduced new driver families not previously associated with SilverFox, expanding its arsenal and providing fallback options should certain drivers be blocked or found incompatible.

The ultimate goal of this intricate attack chain is the delivery of ValleyRAT, a potent remote-access tool. After neutralizing security software, SilverFox establishes communication with its command-and-control (C2) server. It then injects shellcode into a suspended Windows service process. By resuming the suspended process, the injected malicious code executes, further obscuring its presence within legitimate system operations. The malware also attempts to evade detection by restoring a clean in-memory copy of a core Windows library, potentially removing user-level security hooks.

Persistence is a key feature of the SilverFox campaign. The malware establishes a foothold by creating a scheduled task that ensures the loader restarts automatically upon user logon. Furthermore, a watchdog script continuously monitors the loader's activity, restarting it every 30 seconds if it is terminated. A secondary monitoring mechanism is also in place to recreate the injected payload if the compromised process is stopped, ensuring the infection remains resilient even if individual components are disrupted.

Defenders are urged to look beyond simple indicators like filenames or signatures and focus on the entire attack sequence. Useful detection signals include suspicious DLL loading from temporary directories, the creation of services associated with vulnerable drivers, modifications to suspended Windows processes, unusual Registry writes, and persistent watchdog activity. The resilience of the SilverFox campaign, with its multiple layers of evasion and self-recovery mechanisms, underscores the need for a comprehensive, behavior-focused approach to threat detection and incident response.

Security teams should prioritize isolating affected systems immediately, conducting thorough investigations into the full process tree, removing malicious scheduled tasks and driver services, and rotating any credentials that may have been compromised. The ability of SilverFox to rebuild its infection chain even after partial disruption highlights the importance of understanding and mitigating each stage of the attack.