The latest campaign by the persistent **Silver Fox** cybercrime group reveals a significant evolution in their attack methodology. Researchers at **Cato Networks** have detailed a sophisticated multi-stage attack that combines new vulnerable driver abuse, DLL sideloading of legitimate applications, defense evasion, and layered recovery mechanisms to ensure the longevity of their primary payload, **ValleyRAT**. ### The Attack Chain: From Phishing to Kernel Access The intrusion begins with an invoice-themed phishing lure. This initial vector directs victims to attacker-controlled content hosted on legitimate **QQ** and **Tencent Cloud** services. This leads to a DLL sideloading chain delivered via a ZIP archive. Crucially, before deploying **ValleyRAT**, the attackers utilize a BYOVD technique to gain kernel-level access. This allows them to impair security controls on the compromised host, significantly hindering detection efforts.  ### New Drivers and Modular BYOVD Framework While **Silver Fox** has previously exploited drivers like `amsdk.sys` and `wsftprm.sys`, this new campaign introduces two additional drivers: `BootRepair.sys` and `EnPortv.sys`. These drivers have not been publicly associated with **Silver Fox**'s prior attacks. The malicious DLL, `PDFCORE8.dll`, sideloaded by legitimate **Zeon Corporation** binaries `ConvertToPDF.exe` or `PDFDirect.exe`, embeds these drivers, transforming the malware into a modular three-driver BYOVD framework. This design enhances operational resilience, allowing operators to swap drivers while maintaining the core workflow. ### Advanced Evasion and Persistence Beyond BYOVD, the malware employs **NTDLL** unhooking to remove user-mode inline hooks placed by endpoint security solutions, further evading detection by monitoring native Windows API activity. The researchers highlighted that the malware integrates "Bring Your Own Vulnerable Driver (BYOVD), DLL side-loading, NTDLL unhooking, process injection, registry-based payload storage, and two independent recovery mechanisms to impair security controls and maintain execution."  The DLL loader, a self-contained execution framework, also unleashes a watchdog batch script. This script ensures persistence through a scheduled task and communicates with an external server (`43.128.26[.]132`) to fetch shellcode. This shellcode is then injected into a new `svchost.exe` process using thread-context hijacking. ### ValleyRAT: The Final Payload The ultimate goal is the deployment of **ValleyRAT**, a variant of **Gh0st RAT**. This remote access Trojan (RAT) provides comprehensive remote access functionalities, including command-and-control (C2) communication, task execution, and various post-compromise capabilities. ### Dual Watchdog for Unparalleled Resilience A defining feature of this attack is its dual watchdog design, guaranteeing execution recovery. An internal routine monitors the injected payload, while an external watchdog script monitors the loader responsible for creating that payload. This layered approach means that terminating one component alone is insufficient to neutralize the intrusion, as the other will restore it. "This layered design increases resilience because defenders must interrupt both components and prevent either from restoring the other stage," **Cato Networks** stated. "The recovery architecture also reinforces the modularity observed throughout the sample. Driver deployment, security-process termination, injection, payload monitoring, and loader recovery are implemented as coordinated components rather than isolated techniques." ### Silver Fox's Expanding Arsenal This disclosure underscores **Silver Fox**'s continuous efforts to refine and expand its arsenal. The group has recently been observed incorporating new tools like **Atlas RAT** (aka **AtlasCross RAT**), **RomulusLoader**, and **SilentRunLoader**, alongside their continued use of **Gh0st RAT** and **DCRat** in tax-themed phishing campaigns. While a South Korean cybersecurity company recently identified a large number of **Atlas RAT** samples, suggesting potential commercial development or private distribution, the link to **Silver Fox** remains based on circumstantial evidence. Nevertheless, the group's evolving tactics demand heightened vigilance from IT security professionals.