Key Takeaways
- Silver Fox employed a new Bring‑Your‑Own‑Vulnerable‑Driver (BYOVD) framework using the previously unreported drivers BootRepair.sys and EnPortv.sys, alongside the known wsftprm.sys.
- The attack started with an invoice‑themed phishing email that leveraged legitimate QQ and Tencent Cloud hosting to deliver a malicious ZIP archive.
- Inside the ZIP, a downloader retrieves components for DLL side‑loading, which abuses legitimate executables ConvertToPDF.exe and PDFDirect.exe to load PDFCORE8.dll.
- The malware chains BYOVD, DLL side‑loading, NTDLL unhooking, process injection, registry‑based storage, and two independent watchdog mechanisms to maintain persistence and evade defenses.
- A dual‑watchdog design ensures that terminating either the injected payload or the loader triggers automatic recovery, raising the effort required for remediation.
- The final payload is ValleyRAT (a Gh0st RAT variant), providing full remote‑access capabilities including C2 communication, task execution, and post‑compromise tools.
- Silver Fox continues to expand its toolset (Atlas RAT, RomulusLoader, SilentRunLoader) and uses varied lures (tax‑themed, invoice‑themed) to broaden its reach.
- The modular, plug‑and‑play driver approach allows threat actors to swap vulnerable drivers without redesigning the overall attack chain, enhancing operational resilience.
- Defense strategies must therefore focus on monitoring driver loading, blocking unsigned or obscure drivers, detecting DLL side‑loading patterns, and disrupting both the loader and its watchdog mechanisms simultaneously.
Campaign Overview and Target
The Chinese cybercrime group Silver Fox has been observed conducting a sophisticated intrusion against a Japanese organization operating in the industrial manufacturing sector. The campaign’s ultimate goal is to deploy ValleyRAT (also known as Winos 4.0), a persistent remote‑access trojan that grants attackers full control over compromised hosts. By combining several advanced techniques—including a novel Bring‑Your‑Own‑Vulnerable‑Driver (BYOVD) approach, DLL side‑loading, and layered recovery mechanisms—the group aims to bypass security controls, maintain long‑term access, and evade detection.
Initial Phishing Lure and Delivery Mechanism
The intrusion begins with an invoice‑themed phishing email that appears legitimate to the recipient. Rather than attaching malware directly, the email contains a link to attacker‑controlled content hosted on legitimate services such as QQ and Tencent Cloud. When the target clicks the link, a ZIP archive is downloaded from these trusted platforms, exploiting the implicit trust users place in well‑known cloud providers. This use of reputable infrastructure helps the lure bypass email security gateways and reduces suspicion during the initial interaction.
ZIP Archive Contents and Downloader Execution
Inside the delivered ZIP file resides a downloader executable responsible for fetching the next‑stage components required for the attack. This downloader contacts the attacker’s Tencent Cloud infrastructure, retrieves additional payloads, and writes them to the victim’s filesystem. The downloader itself is relatively benign in appearance, which aids in avoiding heuristic detection. Once executed, it sets the stage for the subsequent DLL side‑loading chain that will ultimately load the malicious PDFCORE8.dll module.
Bring Your Own Vulnerable Driver (BYOVD) Deployment
A core innovation in this campaign is Silver Fox’s use of the BYOVD technique to gain kernel‑level privileges and undermine host defenses. While earlier operations relied on the legitimate but vulnerable drivers amsdk.sys and wsftprm.sys, the current wave introduces two previously unreported drivers: BootRepair.sys and EnPortv.sys. These drivers are bundled with the malicious DLL and loaded via vulnerable legitimate executables, granting the attackers raw access to kernel memory and the ability to disable security monitoring tools.
DLL Side‑Loading via ConvertToPDF/PDFDirect
The malicious payload PDFCORE8.dll is sideloaded through two legitimate binaries associated with Zeon Corporation: ConvertToPDF.exe and PDFDirect.exe. Both executables are trusted by the system and commonly present in software suites, making them ideal carriers for side‑loading. When either binary is launched, it inadvertently loads PDFCORE8.dll from the same directory, allowing the malware to execute with the privileges of the trusted application while remaining hidden from casual inspection.
Defense Evasion: NTDLL Unhooking and Process Injection
To further obscure its activities, the malware performs NTDLL unhooking, stripping away any user‑mode inline hooks placed by endpoint detection and response (EDR) solutions. This restores pristine Windows API calls, enabling the attackers to invoke system functions without interference. Following unhooking, the malware injects shellcode into a newly spawned svchost.exe process via thread‑context hijacking—a technique that manipulates the thread’s context to redirect execution to the malicious code. These combined actions help the payload blend into legitimate system activity.
Persistence Architecture and Dual Watchdog Design
Persistence is achieved through a self‑contained DLL loader that creates a watchdog batch script. This script registers a scheduled task that periodically checks the health of the malware components and communicates with an external command‑and‑control server at 43.128.26[.]132 to retrieve fresh shellcode. The loader also launches a second watchdog routine that monitors the injected payload itself. This dual‑watchdog architecture ensures that if either the payload or the loader is terminated, the other component will automatically relaunch it, creating a resilient recovery loop that forces defenders to neutralize both sides simultaneously.
Final‑Stage Implant: ValleyRAT Functionality
Once the recovery mechanisms are active, the malware delivers the final payload: ValleyRAT, a derivative of the well‑known Gh0st RAT family. ValleyRAT provides the attacker with a comprehensive remote‑access toolkit, including bidirectional C2 communication, arbitrary command execution, file upload/download capabilities, screenshot capture, keylogging, and the ability to execute additional modules. Because the implant runs under the guise of a legitimate svchost.exe process and is continuously refreshed by the watchdog mechanisms, it can remain active for extended periods, enabling long‑term espionage or data theft.
Modular Design and Layered Recovery
Throughout the sample, the attackers emphasize modularity. The BYOVD component, DLL side‑loading, NTDLL unhooking, process injection, registry‑based storage, and each watchdog mechanism are implemented as independent yet coordinated modules. This design lets the threat actors swap out individual elements—such as exchanging BootRepair.sys for another vulnerable driver—without rewriting the entire attack chain. The layered recovery mechanisms (internal payload monitor + external watchdog script) reinforce this modularity, ensuring that failure in any single layer does not jeopardize the overall operation.
Broader Threat Landscape and Silver Fox Evolution
Silver Fox’s activity does not exist in isolation. The group continues to develop and distribute additional tools such as Atlas RAT (aka AtlasCross RAT), RomulusLoader, and SilentRunLoader, often employing varied lures—including tax‑themed messages—to spread Gh0st RAT and DCRat. A recent South Korean cybersecurity firm’s 180‑day retro hunt of VirusTotal identified 146 unique Atlas RAT samples spanning multiple versioned PDB builds, development usernames, and heuristic lineages, suggesting a possibly commercial or privately distributed malware ecosystem. While a direct link to Silver Fox remains circumstantial, the overlap in tactics, techniques, and procedures (TTPs) indicates a maturing, adaptive threat actor that continually refines its arsenal.
Implications for Defenders
The campaign underscores the necessity for defenses that extend beyond signature‑based detection. Security teams should monitor for unsigned or obscure kernel drivers, especially those loaded from non‑standard locations, and enforce strict driver signing policies. Detecting DLL side‑loading requires vigilance over executable‑directory anomalies and unexpected module loads from trusted binaries. Additionally, EDR solutions must be capable of spotting NTDLL unhooking attempts and anomalous thread‑context hijacking. Finally, because the threat employs dual watchdogs for recovery, containment strategies must address both the loader and its persistent scripts simultaneously—disabling only one facet will likely result in rapid reinstatement. By adopting a holistic, behavior‑focused approach that couples driver integrity monitoring, API‑call anomaly detection, and coordinated process termination, organizations can markedly reduce the risk of prolonged compromise by Silver Fox and similar adversaries.