The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access.
"In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate applications for DLL sideloading, defense evasion, and layered recovery mechanisms to keep ValleyRAT running," Cato Networks researchers Shani Kurtzberg, Tomer Pugach, Dr. Guy Waizel, Zohar Buber, Idan Tarab, and Shani Kurtzberg said in an analysis.
The attack chain begins with an invoice-themed phishing lure that uses attacker-controlled content hosted on legitimate QQ and Tencent Cloud services to trigger a DLL side-loading chain via a ZIP archive that paves the way for the deployment of ValleyRAT, but not before leveraging the BYOVD technique to obtain kernel access and impair security controls on the compromised host to evade detection.
The ZIP archive contains a downloader executable that retrieves the next-stage components necessary for DLL side-loading from an attacker-controlled Tencent Cloud infrastructure.
While Silver Fox has previously leveraged this method using the legitimate-but-vulnerable "amsdk.sys" and "wsftprm.sys" drivers, the latest campaign marks the use of two other drivers: "BootRepair.sys" and "EnPortv.sys," which have not been publicly reported in connection with prior attack waves.
Specifically, the malicious DLL ("PDFCORE8.dll") sideloaded by "ConvertToPDF.exe" or "PDFDirect.exe" embeds "BootRepair.sys," "EnPortv.sys," and wsftprm.sys," turning the malware into a modular three-driver BYOVD framework for defense evasion. Both legitimate binaries are associated with Zeon Corporation.
The idea behind incorporating three different drivers is to ensure operational resilience across environments and turn the BYOVD implementation into a plug-and-play system that allows the operators to swap out the drivers and replace them with other options while keeping the rest of the workflow intact.
On top of that, the malware uses NTDLL unhooking to remove user-mode inline hooks placed by endpoint security software to keep tabs on native Windows API activity.
"The malware integrates Bring Your Own Vulnerable Driver (BYOVD), DLL side-loading, NTDLL unhooking, process injection, registry-based payload storage, and two independent recovery mechanisms to impair security controls and maintain execution," the researchers said.
The DLL loader, which acts as a self-contained execution framework, is also responsible for unleashing a watchdog batch script that ensures persistence by means of a scheduled task and communicates with an external server ("43.128.26[.]132") to fetch shellcode that's injected into a new "svchost.exe" process using a technique called thread-context hijacking.
The resulting final-stage implant is ValleyRAT, a variant of Gh0st RAT that offers remote-access functionality, including command-and-control (C2) communication, task execution, and additional post-compromise capabilities.
A defining aspect of the attack sequence is its dual watchdog design that ensures execution recovery. It pairs an internal routine that monitors the injected payload with the aforementioned external watchdog script that monitors the loader behind the creation of that payload.
This two-pronged approach means that terminating one component alone may not completely neutralize the intrusion. If the injected payload exits, it's recreated by the loader. If the loader itself gets terminated, the watchdog script springs into action to relaunch it.
"This layered design increases resilience because defenders must interrupt both components and prevent either from restoring the other stage," Cato said.
"The recovery architecture also reinforces the modularity observed throughout the sample. Driver deployment, security-process termination, injection, payload monitoring, and loader recovery are implemented as coordinated components rather than isolated techniques."
The disclosure comes as Silver Fox continues to actively refine and expand its arsenal with new tools, such as Atlas RAT (aka AtlasCross RAT), RomulusLoader, and SilentRunLoader, even as the group utilizes tax-themed lures to deliver Gh0st RAT and DCRat.
In a report published this week, a South Korean cybersecurity company said its 180-day retrohunt of the VirusTotal corpus identified 146 unique samples of Atlas RAT spanning six versioned PDB builds, two development environment usernames, and 27 heuristic lineages.
"It is noted that such scale and diversity are inconsistent with management by a single operator, raising the possibility that the malware was commercially developed or distributed privately," the company said. "However, the link to Silver Fox has only been suggested based on circumstantial evidence, and there is insufficient evidence to conclusively determine that they are the same operator."