Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.
- New BYOVD drivers BootRepair.sys and EnPortv.sys abused for kernel access and defense impairment.
- Invoice-themed phishing uses attacker-hosted QQ and Tencent Cloud content for DLL side-loading.
- Modular three-driver BYOVD framework, NTDLL unhooking, and dual watchdogs keep ValleyRAT resilient.
- Shellcode injected into svchost.exe via thread-context hijacking; C2 at 43.128.26.132.
- Retrohunt found 146 Atlas RAT samples across six PDB builds and 27 lineages.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1574.002 DLL Side-LoadingT1562.001 Impair Defenses: Disable or Modify ToolsT1055.003 Thread Execution HijackingT1053.005 Scheduled Task
- Vendors
- Cato Networks
- Threat actors
- Silver Fox
- Organizations
- Zeon Corporation
- Countries
- Japan
From the original article
3 min read at thehackernews.com
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4. 0) for persistent remote access.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.