Full Report
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access. "In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate
Analysis Summary
# Threat Actor: Silver Fox
## Attribution & Identity
Silver Fox is a Chinese cybercrime group (also known for its association with campaigns delivering ValleyRAT/Winos 4.0). While the article does not provide a specific government attribution ID, it notes the group has ties to the Chinese cyber ecosystem and shares infrastructure patterns with other "China-linked" operations.
## Activity Summary
In July 2026, Silver Fox was observed targeting a Japanese industrial manufacturing organization. The campaign utilized a sophisticated 3-driver "Bring Your Own Vulnerable Driver" (BYOVD) chain to disable local security software and deliver the **ValleyRAT** (aka Winos 4.0) malware. This operation is characterized by its modularity and high degree of persistence through dual "watchdog" mechanisms.
## Tactics, Techniques & Procedures
* **Initial Access**: Invoice-themed phishing lures.
* **Defense Evasion**:
* **BYOVD (Bring Your Own Vulnerable Driver)**: Leveraging legitimate but vulnerable drivers to gain kernel access and terminate security processes.
* **DLL Side-Loading**: Using legitimate binaries (e.g., from Zeon Corporation) to load malicious DLLs.
* **NTDLL Unhooking**: Removing user-mode inline hooks placed by EDR/Antivirus tools.
* **Process Injection**: Thread-context hijacking into `svchost.exe`.
* **Persistence**:
* **Scheduled Tasks**: Established via watchdog batch scripts.
* **Dual Watchdog Design**: Monitoring both the loader and the payload to ensure that if one is terminated, the other restores it.
* **MITRE ATT&CK Mapping (Inferred from text)**:
* T1068 - Exploitation for Privilege Escalation (BYOVD)
* T1574.002 - DLL Side-Loading
* T1055.003 - Thread Execution Hijacking
* T1053.005 - Scheduled Task
## Targeting
* **Sectors**: Industrial Manufacturing.
* **Geography**: Japan.
* **Victims**: A specific unnamed Japanese manufacturing organization; historical targeting of Taiwan has also been noted.
## Tools & Infrastructure
* **Malware**:
* **ValleyRAT (Winos 4.0)**: A variant of Gh0st RAT used for remote access and C2.
* **Downloader Executable**: Custom ZIP-contained downloader.
* **Legitimate but Vulnerable Drivers**:
* `BootRepair.sys`
* `EnPortv.sys`
* `wsftprm.sys`
* `amsdk.sys` (historical)
* **Infrastructure**:
* Host Services: Legitimate QQ and Tencent Cloud services for content hosting.
* **C2 Server**: 43.128.26[.]132
## Implications
Silver Fox has evolved from a standard cybercrime entity into a highly sophisticated threat capable of kernel-level defense evasion. The shift to a "plug-and-play" BYOVD framework indicates a strategic move toward modularity, allowing the group to rapidly swap out vulnerable drivers as they are blacklisted by security vendors. Their focus on the industrial sector in Japan suggests a potential shift toward corporate espionage or high-value financial extortion.
## Mitigations
* **Driver Blocklisting**: Implement Microsoft’s "Vulnerable Driver Blocklist" or use EDR policies to prevent the loading of known vulnerable drivers like `BootRepair.sys`, `EnPortv.sys`, and `wsftprm.sys`.
* **DLL Sideloading Protection**: Monitor for legitimate signed binaries (like those from Zeon Corporation) executing from unusual paths or loading unsigned/unexpected DLLs.
* **Hook Integrity Monitoring**: Utilize security tools that can detect or prevent NTDLL unhooking attempts.
* **Persistence Monitoring**: Audit the creation of new Scheduled Tasks and batch scripts in temporary directories, especially those communicating with Tencent Cloud infrastructure.