Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
Summary: The Chinese cybercrime group Silver Fox targeted a Japanese industrial manufacturing organization with an invoice-themed phishing lure that used attacker-controlled content on QQ and Tencent Cloud to trigger a DLL side-loading chain and deliver ValleyRAT (Winos 4.0) for persistent remote access. The campaign used a modular three-driver BYOVD framework - BootRepair.sys and EnPortv.sys, not previously reported in this context, plus wsftprm.sys - embedded in a malicious PDFCORE8.dll sideloaded by Zeon Corporation binaries ConvertToPDF.exe or PDFDirect.exe, alongside NTDLL unhooking, process injection, and a dual watchdog design that recreates the payload if it exits and relaunches the loader if it is terminated.
Key Takeaway: The two-pronged watchdog means terminating one component does not neutralize the intrusion - defenders must interrupt both the injected payload and the loader behind it, or the other stage restores it. The three-driver design is plug-and-play, so the operators can swap drivers while keeping the rest of the workflow intact.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026