A Chinese cybercrime group known as Silver Fox is back with new tricks. The threat actors have been observed using previously unreported drivers as part of bring your own vulnerable driver attacks targeting a Japanese organization in the industrial manufacturing sector.
The ultimate goal is deploying ValleyRAT, also known as Winos 4.0, for persistent remote access. Cato Networks researchers detailed the campaign in a recent analysis, and The Hacker News has been covering the group's evolving tactics.
The attack chain is sophisticated. It combines new vulnerable-driver abuse, DLL sideloading through legitimate applications, defense evasion techniques, and layered recovery mechanisms to keep the malware running. Here is an overview of the Silver Fox operation and its significance to defenders.
Silver Fox: An Overview
The Silver Fox is an online crime group operating from China. The group has a record of carrying out attacks on organizations by use of malware and using innovative means of delivering the attack. These criminals have made use of the vulnerable drivers amsdk.sys and wsftprm.sys in the BYOVD attack.
The group is continuing to improve their capabilities by adding new tools to their kit. Some of these include Atlas RAT, RomulusLoader, and SilentRunLoader. They have also been observed using tax-themed lures to deliver Gh0st RAT and DCRat.
The latest Silver Fox campaign shows the group is not resting on its laurels. New technologies and tools are continuously developed by them in order to be always one step ahead of defenders.
The Silver Fox Attack Chain Unpacked
The Silver Fox attack chain starts with the invoice-related phishing lure. They use content available on legitimate QQ and Tencent Cloud services in order to increase the credibility of their emails. It is a rather popular technique as the use of trusted services allows avoiding security filters.
The victim receives a ZIP archive that contains a downloader executable. When the victim opens the archive and runs the executable, it retrieves the next-stage components from attacker-controlled Tencent Cloud infrastructure. It is here that the action really starts.
The downloader initiates a chain of DLL sideloading. Legitimate applications like ConvertToPDF.exe or PDFDirect.exe, both associated with Zeon Corporation are used to load a malicious DLL called PDFCORE8.dll. This DLL contains three vulnerable drivers that turn the malware into a modular BYOVD framework.
The New Vulnerable Drivers in This Campaign
This is where the Silver Fox campaign gets interesting. While the group has previously used amsdk.sys and wsftprm.sys, the latest campaign marks the use of two drivers that have not been publicly reported in connection with prior attack waves: BootRepair.sys and EnPortv.sys.
The malicious DLL embeds BootRepair.sys, EnPortv.sys, and wsftprm.sys. This gives the attackers a modular three-driver BYOVD framework for defense evasion. The purpose of integrating the three different drivers is to provide operational robustness through varied environments.
The drivers can be swapped out by the Silver Fox operators for some other set of drivers without disrupting anything else in the process. This makes BYOVD solution become plug-and-play compatible with Windows environments.
Understanding BYOVD and Its Dangers
Bring your own vulnerable driver is a technique where attackers abuse legitimate but vulnerable kernel drivers to gain elevated privileges. The vulnerabilities present in the drivers make it possible for an attacker to execute code within the Windows kernel.
Within the Silver Fox attack campaign, the vulnerable drivers are employed to gain access to the Windows kernel to subvert security controls of the compromised machine. This makes it easy for the malicious program to escape detection or even disable security programs running on the endpoint.
BYOVD attacks are very dangerous considering they exploit vulnerabilities at the kernel level. With kernel-level access, almost anything becomes possible for the attacker. The security programs that depend on user-mode hooks can be easily circumvented or completely neutralized.
ValleyRAT and Winos 4.0 Explained
ValleyRAT, also known as Winos 4.0, is a variant of Gh0st RAT. Remote access capabilities are included within the threat, such as command-and-control communications, task execution, and other post-exploitation activities.
This threat arrives via the ValleyRAT implant once the BYOVD drivers are delivered and any security mechanisms have been degraded. This malware grants the attackers persistence remote access capability to the infected host.
The final stage of the implant is delivered using the thread-context hijacking method. This involves the shellcode being injected into a new svchost.exe process, establishing a foothold that is difficult to detect and remove.
The Defense Evasion Techniques Used
The Silver Fox campaign uses multiple defense evasion techniques beyond just the BYOVD drivers. Moreover, this malware makes use of NTDLL unhooking to uninstall any user mode inline hooks that may have been set by the endpoint security program.
There are endpoint security products that are known to set up hooks on the NTDLL to track any calls to the native APIs on Windows. Unhooking NTDLL will allow the malware to run undetected.
The malware also applies process injection and registry-based payload storage techniques to conceal itself.
Dual Watchdog Recovery Design
One of the most exciting things about the Silver Fox operation is its dual watchdog recovery design feature. The malware pairs an internal routine that monitors the injected payload with an external watchdog batch script that monitors the loader behind the creation of that payload.
Here is how it works:
- The loader creates the injected payload in a new svchost.exe process
- An internal routine monitors the injected payload and recreates it if it exits
- An external watchdog batch script monitors the loader itself
- If the loader is terminated, the watchdog script relaunches it
This two-pronged approach means that terminating one component alone may not completely neutralize the intrusion. If the injected payload exits, it is recreated by the loader. If the loader itself gets terminated, the watchdog script springs into action to relaunch it.
As the Cato researchers put it: "This layered design increases resilience because defenders must interrupt both components and prevent either from restoring the other stage."
Observations from the Recovery Architecture
The recovery architecture emphasizes the modularity seen in the Silver Fox sample. Driver deployment, security process termination, injection, payload monitoring, and loader recovery are performed through modular components, not stand-alone techniques.
It is a very important point. The Silver Fox attacks do not involve any haphazard techniques. On the contrary, it involves a well-coordinated modular system whereby all components work in synergy to realize the main objective. In addition, the recovery mechanisms guarantee that any disruption of the attack will be restored by other elements of the technique.
The Expanding Silver Fox Arsenal
The disclosure about the Silver Fox campaign comes as the group continues to actively refine and expand its arsenal with new tools. The group has been observed using Atlas RAT, RomulusLoader, and SilentRunLoader.
A South Korean cybersecurity company conducted a 180-day retrohunt of the VirusTotal corpus and identified 146 unique samples of Atlas RAT. These samples spanned six versioned PDB builds, two development environment usernames, and 27 heuristic lineages.
The scale and diversity of the Atlas RAT samples suggest something interesting. The researchers noted that such scale and diversity are inconsistent with management by a single operator. This raises the possibility that Atlas RAT was commercially developed or distributed privately.
However, the link to Silver Fox has only been suggested based on circumstantial evidence. There is insufficient evidence to conclusively determine that they are the same operator.
Practical Countermeasures for Silver Fox Attacks
Silver Fox attack on Japanese Manufacturing is an example of how dangerous the cybercriminal group is. This should alert organizations working in the manufacturing industry as well as other sectors.
Here are some practical steps:
- Implement robust email filtering to detect phishing lures
- Restrict the execution of legitimate applications used for DLL sideloading
- Monitor for the use of vulnerable drivers and block known vulnerable drivers
- Implement endpoint detection and response solutions that can detect BYOVD attacks
- Use application whitelisting to prevent unauthorized executables from running
- Monitor for suspicious process injection and registry modifications
The Silver Fox campaign also highlights the importance of layered defense. The dual watchdog design shows that attackers are thinking about recovery and resilience. Defenders need to think the same way.
The Bottom Line on Silver Fox
The Silver Fox campaign is a sophisticated attack that combines multiple techniques to deliver ValleyRAT to a Japanese manufacturing organization. The attackers used vulnerable drivers never heard of before in a BYOVD attack, employed DLL sideloading via legitimate applications, and developed a dual-watchdog design for recovery purposes.
This shows the fact that the group continues to develop and advance its techniques. In other words, Silver Fox is not only using old tools but also developing new ones.
For defenders, the Silver Fox campaign is a reminder that modern attacks are modular and resilient. The disruption of one component within the chain will not do; you must have the whole picture in mind and be ready to disrupt more than one component at a time.
The Silver Fox campaign is ongoing. The group will continue to target organizations with new lures and new tools. Stay vigilant, stay updated, and stay prepared.
FAQ Section
What is the Silver Fox attack campaign?
Silver Fox is a Chinese-based group which has recently paid particular interest to a manufacturing company located in Japan using BYOVD attacks. In this particular attack, Silver Fox makes use of driver vulnerability, DLL sideloading, and recovery techniques to offer ValleyRAT remote access.
What vulnerable drivers did Silver Fox use?
The campaign used BootRepair.sys and EnPortv.sys, which have not been publicly reported in prior attack waves, along with wsftprm.sys. These drivers form a modular three-driver BYOVD framework for defense evasion.
What is ValleyRAT and what does it do?
ValleyRAT, which may also be called Winos 4.0, is a form Gh0st RAT that provides access capabilities, including communication, tasking, and post-exploitation operations.
What is the dual watchdog recovery mechanism?
The malware has a self-monitoring mechanism using the payload injection routine internally and the watchdog batch file externally for the loader. Any termination of one results in the activation of the other, which makes the malware resistant to being disrupted.
Are there any other tools utilized by Silver Fox?
Silver Fox is known to deploy the following: Atlas RAT, RomulusLoader, and SilentRunLoader. There are some indications that Atlas RAT could have been created for commercial purposes; however, the connection with Silver Fox is yet to be proven.
