Chinese cybercrime group Silver Fox used new drivers in a bring-your-own-vulnerable-driver attack on a Japanese industrial-manufacturing organization, ultimately delivering the ValleyRAT remote-access trojan for persistent access. Research by Cato Networks shows the campaign combining invoice-themed phishing lures hosted on legitimate QQ and Tencent Cloud services with a modular three-driver BYOVD framework and dual watchdog persistence that makes remediation materially harder.
Silver Fox’s Invoice-Themed Lure Abuses QQ and Tencent Cloud
The attack chain begins with an invoice-themed phishing lure using attacker-controlled content hosted on legitimate QQ and Tencent Cloud services, which triggers a DLL side-loading chain delivered through a ZIP archive. The archive contains a downloader that retrieves the next-stage components from attacker-controlled Tencent Cloud infrastructure. The reliance on legitimate cloud services for the lure stage means the malicious content travels under trusted domains and is less likely to be blocked by reputation-based filtering.
PDFCORE8.dll Side-Loading Turns the ZIP Into a Three-Driver BYOVD Framework
The malicious DLL, PDFCORE8.dll, is sideloaded by the legitimate binaries ConvertToPDF.exe or PDFDirect.exe, both associated with Zeon Corporation. It embeds three drivers, BootRepair.sys, EnPortv.sys, and wsftprm.sys, turning the malware into a modular three-driver BYOVD framework. Cato noted that BootRepair.sys and EnPortv.sys have not been publicly reported in connection with prior attack waves, marking an expansion of Silver Fox’s driver arsenal. The BYOVD technique obtains kernel access and impairs security controls on the compromised host, while the malware also uses NTDLL unhooking to remove user-mode inline hooks placed by endpoint security software.
Dual Watchdog Persistence: Interrupting One Component Is Not Enough
A watchdog batch script ensures persistence through a scheduled task and communicates with an external server to fetch shellcode that is injected into a new svchost.exe process using thread-context hijacking. The design is a dual watchdog: an internal routine monitors the injected payload while an external watchdog script monitors the loader. Cato’s researchers said terminating one component alone may not neutralize the intrusion, and defenders must interrupt both components and prevent either from restoring the other stage.
ValleyRAT’s Final Stage and Silver Fox’s Expanding Tool Arsenal
The final stage, ValleyRAT, also known as Winos 4.0, is a variant of the Gh0st RAT family offering command-and-control communication, task execution, and additional post-compromise capabilities. Silver Fox continues to expand its toolkit with new malware such as Atlas RAT, RomulusLoader, and SilentRunLoader. A South Korean vendor’s 180-day retrohunt of VirusTotal identified 146 unique Atlas RAT samples, raising the possibility that the malware was commercially developed or privately distributed rather than built in-house.
Defender Hunting Guidance for BYOVD in Industrial Environments
No CVE applies to the campaign because it abuses existing drivers rather than exploiting a patched vulnerability. Cato’s researchers recommend hunting for suspicious driver loading involving BootRepair.sys, EnPortv.sys, and wsftprm.sys, DLL side-loading of PDFCORE8.dll, watchdog scheduled tasks, thread-context hijacking into svchost.exe, and outbound communications to the attacker’s infrastructure. Endpoint protection should include driver-load allow and block lists so that unknown kernel drivers cannot load on managed hosts.
Why Kernel Access Matters for a Financially Motivated Actor
BYOVD techniques have historically been associated with sophisticated operators willing to sacrifice the burned driver in exchange for disabling security controls. Silver Fox’s use of a fresh three-driver set shows a financially motivated group investing in kernel-level capability to guarantee the remote-access trojan survives endpoint defenses in an industrial environment. The layered design, with two independent recovery mechanisms and NTDLL unhooking on top of driver abuse, is notable because each layer on its own would complicate removal; combined, they force incident responders to clean both the loader and the injected payload in a coordinated sweep, or risk reinfection from whichever component survives.
The Growing Commercialization of Silver Fox’s Toolkit
The 146 unique Atlas RAT samples found in VirusTotal retrohunting point toward a broader supply of ready-made malware reaching the group. If malware of this quality is being commercially distributed or privately distributed, then other cybercrime groups may soon operate with similar kernel-level capability. That would lower the barrier for driver-based defense evasion across the ransomware and initial-access ecosystem, extending a technique once reserved for state-sponsored operations into the commodity crime market.
What the Campaign Signals for Industrial Endpoint Defense
The intrusion pattern of a Japanese manufacturer reached through legitimate cloud infrastructure, an invoice lure, and a kernel-level BYOVD chain puts direct pressure on industrial organizations to validate driver loading and restrict software execution. Because the lure stage uses trusted services and the payload stage abuses kernel drivers, no single network layer fully contains the threat; organizations in manufacturing and other industrial sectors are the ones most likely to need driver-load controls and outbound traffic monitoring to detect this style of attack.
