Silver Fox Deploys ValleyRAT Through a Three-Driver BYOVD Chain

Silver Fox adds a three-driver BYOVD chain

Silver Fox targeted a Japanese industrial manufacturer with an invoice-themed phishing campaign that installs ValleyRAT, also known as Winos 4.0. Cato Networks found that the chain embeds three vulnerable drivers to gain kernel access, impair security controls and preserve remote access.

The lure uses attacker-controlled content on legitimate QQ and Tencent Cloud services. A ZIP archive carries a downloader that retrieves components from the attackers' Tencent Cloud infrastructure and launches DLL side-loading.

How the chain evades endpoint defenses

The malicious PDFCORE8.dll is loaded by ConvertToPDF.exe or PDFDirect.exe, legitimate Zeon Corporation binaries. It embeds BootRepair.sys, EnPortv.sys and wsftprm.sys, forming a modular three-driver BYOVD framework.

Silver Fox had used wsftprm.sys and amsdk.sys in prior activity. Cato Networks said BootRepair.sys and EnPortv.sys had not been publicly reported in earlier attack waves. The three options allow drivers to be swapped without changing the rest of the workflow.

The malware unhooks NTDLL to remove user-mode inline hooks that endpoint tools place around native Windows API activity. It also combines process injection, registry-based payload storage and security-process termination.

Persistence requires full-chain containment

The loader creates a watchdog batch script, persists through a scheduled task and contacts 43.128.26[.]132 for shellcode. The code is injected into a new svchost.exe process through thread-context hijacking. The final ValleyRAT implant supports command-and-control communication, task execution and further post-compromise activity.

Recovery has two paths: an internal routine monitors the injected payload, while an external script watches the loader. If the payload exits, the loader recreates it; if the loader stops, the script relaunches it. Terminating one component may not neutralize the intrusion.

Defenders therefore need to investigate vulnerable-driver loading, DLL side-loading, injected svchost.exe activity and registry payload storage. Containment should verify that both recovery paths are disabled, rather than stopping at a single malicious process.