SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group Silver Fox has been observed targeting a Japanese industrial manufacturing organization with a sophisticated attack chain that leverages three vulnerable drivers in a Bring Your Own Vulnerable Driver (BYOVD) framework to deliver ValleyRAT (also known as Winos 4.0). The campaign, analyzed by Cato Networks researchers, begins with an invoice-themed phishing lure hosted on legitimate QQ and Tencent Cloud services. A ZIP archive containing a downloader executable retrieves next-stage components for DLL side-loading from attacker-controlled Tencent Cloud infrastructure.

The malicious DLL (PDFCORE8.dll) sideloaded by legitimate Zeon Corporation binaries (ConvertToPDF.exe or PDFDirect.exe) embeds three drivers: BootRepair.sys, EnPortv.sys, and wsftprm.sys. This modular three-driver BYOVD framework provides defense evasion and operational resilience, allowing operators to swap drivers while keeping the workflow intact. The malware also uses NTDLL unhooking to remove user-mode hooks placed by endpoint security software.

The DLL loader acts as a self-contained execution framework, deploying a watchdog batch script that ensures persistence via a scheduled task and communicates with an external server (43.128.26[.]132) to fetch shellcode injected into a new svchost.exe process using thread-context hijacking. The final payload is ValleyRAT, a variant of Gh0st RAT offering remote access, C2 communication, and post-compromise capabilities.

A defining aspect is the dual watchdog design: an internal routine monitors the injected payload, while an external watchdog script monitors the loader. This layered recovery mechanism means terminating one component alone may not neutralize the intrusion. Silver Fox continues to refine its arsenal with tools like Atlas RAT, RomulusLoader, and SilentRunLoader, and has been linked to tax-themed lures delivering Gh0st RAT and DCRat.