The SilverFox threat group has expanded its malware toolkit in a campaign targeting a Japanese industrial manufacturer. The operation used an invoice-themed phishing email, trusted cloud services, DLL sideloading, vulnerable Windows drivers, and ValleyRAT to establish persistent remote access.

The campaign demonstrates how attackers can combine several legitimate-looking components into a layered intrusion that is difficult to detect and remove. Cato Networks researchers linked the activity to SilverFox with moderate-to-high confidence.securityaffairs

Key Details

The attack began with a fake invoice email that directed the recipient to download a ZIP archive hosted through services that normally appear legitimate, including QQ and Tencent Cloud infrastructure. The archive contained a trusted PDF-related executable alongside a malicious library.

When the legitimate program launched, Windows loaded the attacker-controlled DLL from the same directory. This technique, known as DLL sideloading, allows malicious code to run under the cover of a trusted application.unit42.paloaltonetworks

The campaign abused legitimate applications including:

• ConvertToPDF.exe.
• PDFDirect.exe.
• A renamed application resembling MicrosoftEdgeUpdate.exe.

The malicious library, identified as PDFCORE8.dll, acted as the main loader and managed the next stages of the intrusion.

Technical Analysis

The SilverFox loader embedded several signed but vulnerable kernel drivers, including BootRepair.sys, EnPortv.sys, and wsftprm.sys. This is an example of Bring Your Own Vulnerable Driver, or BYOVD, abuse.

The drivers gave the malware a way to terminate protected antivirus and endpoint-security processes from kernel level. Two of the driver families had not previously been publicly associated with SilverFox, giving the group additional options if one driver was blocked or incompatible.scworld+1

After weakening security controls, the malware contacted its command-and-control infrastructure and injected shellcode into a suspended Windows service process. It altered the process execution path so that the shellcode ran when the service resumed.

The campaign also attempted to restore a clean in-memory copy of a core Windows library, a technique that may remove some user-level security hooks. However, this does not eliminate kernel logging, network monitoring, or behavior-based detection.

Persistence and Resilience

SilverFox built multiple recovery mechanisms into the infection chain. The malware created a scheduled task to restart its loader after user logon and used a watchdog script to check periodically whether the loader was still active.

A second monitoring mechanism could recreate the injected payload if defenders terminated the affected process. This dual-layer recovery design means stopping one process or deleting one file may not remove the infection.

The final payload, ValleyRAT, also known as Winos 4.0, provides remote-access capabilities including command execution, command-and-control communication, and additional post-compromise activity.thehackernews

Why It Matters

The campaign is significant because it targets an industrial manufacturer and uses kernel-level defense evasion before deploying a remote-access trojan. ValleyRAT access could allow attackers to:

• Execute commands remotely.
• Collect host and system information.
• Download additional payloads.
• Maintain long-term access.
• Move laterally across the environment.
• Target production and operational systems.

The use of signed applications does not mean the software developers participated in the campaign. The legitimate programs were abused as sideloading hosts, while the malicious DLL supplied the attacker-controlled functionality.

Expert Recommendations

Security teams should investigate behavior across the full process chain rather than relying on a single filename, hash, or domain. Blocking one component may not be enough if the malware can restore itself through scheduled tasks, watchdogs, or registry-stored payloads.

Recommended actions:

• Isolate suspected systems immediately.
• Investigate the complete process tree from the phishing email onward.
• Remove malicious scheduled tasks and driver services.
• Review for suspicious DLL loading from temporary or user-writable folders.
• Detect vulnerable-driver service creation.
• Monitor suspended processes followed by memory modification.
• Inspect unusual Registry writes under HKCU\Console\0 and HKLM\SOFTWARE\IpDates_sun.
• Rotate credentials exposed during remote access.
• Review network connections to the listed command-and-control infrastructure.
• Check for suspicious use of PDFCORE8.dll, ConvertToPDF.exe, and PDFDirect.exe.

Useful behavioral indicators include suspicious signed applications launching from temporary directories, endpoint-security processes being terminated, repeated watchdog activity, and unexpected remote-control connections.

Indicators of Compromise

Type	Indicator	Description
Domain	file[.]wx2[.]qq[.]com	Hosting or redirection for the invoice-themed archive
Domain	hrefbfdhfhgre-1422102728[.]cos[.]ap-hongkong[.]myqcloud[.]com	Second-stage hosting
IP address	43[.]128[.]26[.]132	Command-and-control and shellcode delivery
Registry path	HKCU\Console\0	Stores downloaded shellcode as REG_BINARY data
Registry path	HKLM\SOFTWARE\IpDates_sun	Stores command-and-control configuration
File	PDFCORE8.dll	Malicious sideloaded DLL
File	ConvertToPDF.exe	Legitimate sideloading host
File	PDFDirect.exe	Legitimate sideloading host
Driver	BootRepair.sys	Vulnerable driver used for defense evasion
Driver	EnPortv.sys	Vulnerable driver used for defense evasion
Driver	wsftprm.sys	Vulnerable driver associated with CVE-2023-52271
Ports	778, 779	Ports stored in the ValleyRAT configuration
Marker	FaCai2024	Configuration marker

The indicators are intentionally defanged where applicable. Security teams should validate them in controlled threat-intelligence, SIEM, or incident-response platforms rather than opening them directly.

Industry Context

SilverFox’s activity reflects a broader trend in which attackers abuse signed software, vulnerable drivers, and legitimate cloud services to avoid detection. DLL sideloading remains effective because Windows may search an executable’s own directory before looking for the legitimate library elsewhere.unit42.paloaltonetworks

The campaign also shows why industrial organizations need strong application control and driver-blocking policies. A trusted executable can still become dangerous when it is paired with a malicious library, and a signed driver can still create risk when it contains exploitable functionality.

Conclusion

The SilverFox campaign combines invoice phishing, DLL sideloading, BYOVD abuse, process injection, and layered persistence to deliver ValleyRAT against a Japanese industrial manufacturer. Defenders should focus on the entire behavior chain and rebuild affected systems when necessary rather than removing only the visible malware component.

FAQ SECTION

What is SilverFox?

SilverFox is a threat group associated with malware campaigns that use phishing, vulnerable drivers, and trusted software abuse to gain persistent access.

What is ValleyRAT?

ValleyRAT, also known as Winos 4.0, is a remote-access trojan capable of command execution, system reconnaissance, and additional post-compromise activity.

How did the attack begin?

The campaign began with an invoice-themed phishing email containing or linking to a ZIP archive hosted through legitimate-looking cloud services.

What is DLL sideloading?

DLL sideloading occurs when attackers place a malicious library beside a legitimate executable so Windows loads the attacker-controlled DLL when the trusted program starts.

What should affected organizations do?

Isolate the system, investigate drivers and scheduled tasks, review process injection and Registry activity, rotate exposed credentials, and assess connected systems for lateral movement.