Silver Fox Deploys 3-Driver BYOVD Chain to Drop ValleyRAT in Japan

The Chinese-linked threat actor Silver Fox has been linked to a new campaign targeting a Japanese industrial manufacturer using a three-driver bring-your-own-vulnerable-driver (BYOVD) framework to ultimately deploy ValleyRAT, also tracked as Winos 4.0. Researchers at Cato Networks identified the operation, which combines previously unreported vulnerable drivers, DLL sideloading through legitimate applications, NTDLL unhooking, and layered recovery mechanisms to maintain persistent remote access while disabling endpoint defenses on compromised hosts.

The attack begins with an invoice-themed phishing lure that points victims to attacker-controlled content hosted on legitimate QQ and Tencent Cloud services. The ZIP archive contains a downloader executable that retrieves next-stage components from attacker-controlled Tencent Cloud infrastructure. Silver Fox previously relied on the legitimate-but-vulnerable amsdk.sys and wsftprm.sys drivers, but the latest campaign adds two previously undocumented drivers, BootRepair.sys and EnPortv.sys, both associated with Zeon Corporation. A malicious DLL, PDFCORE8.dll, sideloaded via ConvertToPDF.exe or PDFDirect.exe, embeds all three drivers, creating a modular plug-and-play BYOVD framework that lets operators swap components while preserving the broader attack workflow.

The DLL loader also fires a watchdog batch script that establishes persistence through a scheduled task and reaches out to the command-and-control server at 43.128.26[.]132 to fetch shellcode injected into a new svchost.exe process via thread-context hijacking. Defenders investigating similar incidents can run a WHOIS lookup on the suspected C2 IP to uncover infrastructure overlaps, then use a port scanner to confirm exposed services on potentially affected hosts, and finally validate certificate hygiene on outbound endpoints with an SSL/TLS checker.

The operation combines process injection, registry-based payload storage, and two independent recovery routines, ensuring Silver Fox can re-establish footholds even after partial remediation. By weaponizing signed Zeon Corporation binaries and abusing trusted cloud platforms, the group continues to blur the line between legitimate software and malicious tradecraft, raising the bar for detection and incident response across the industrial manufacturing sector.