SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT SilverFox 针对日本制造商使用三驱动程序 BYOVD 链和 ValleyRAT

TL;DR

• Silver Fox, a Chinese cybercrime group, employs a sophisticated multi-stage attack chain targeting Japanese industrial manufacturers using Bring Your Own Vulnerable Driver (BYOVD) techniques and DLL sideloading to deliver ValleyRAT.
• The campaign introduces two previously unseen vulnerable drivers—“BootRepair.sys” and “EnPortv.sys”—combined with the known “wsftprm.sys,” forming a modular three-driver BYOVD framework for enhanced resilience and evasion.
• The malware leverages NTDLL unhooking, process injection, registry-based payload storage, and a dual-watchdog recovery mechanism to maintain persistence and resist termination by security tools.
• Attack delivery begins with invoice-themed phishing via legitimate QQ and Tencent Cloud services, enabling stealthy initial access and subsequent exploitation of trusted binaries from Zeon Corporation.
• The final implant, ValleyRAT (a Gh0st RAT variant), provides full remote access capabilities, while the layered recovery design ensures that disrupting one component does not eliminate the threat.

Why It Matters

This attack exemplifies how advanced persistent threat (APT) groups are increasingly combining legitimate software abuse, kernel-level vulnerabilities, and modular recovery architectures to bypass modern endpoint defenses. For AI practitioners and security researchers, understanding these hybrid attack patterns is critical for developing more robust detection models that can identify behavioral anomalies in driver loading, API hook manipulation, and inter-component coordination rather than relying solely on static signatures.

Technical Details

• Attack Vector: Phishing email with an invoice-themed lure containing a ZIP archive downloaded from attacker-controlled Tencent Cloud infrastructure; the archive includes a downloader executable that fetches next-stage components.
• DLL Sideloading Abuse: Malicious DLL (“PDFCORE8.dll”) is loaded through legitimate executables (“ConvertToPDF.exe” or “PDFDirect.exe”) associated with Zeon Corporation, exploiting Windows’ DLL search order to execute malicious code without raising suspicion.
• Three-Driver BYOVD Framework: Embeds three vulnerable kernel-mode drivers—“BootRepair.sys”, “EnPortv.sys”, and “wsftprm.sys”—to gain ring 0 access, disable security controls, and evade detection via signature whitelisting of signed but flawed drivers.
• Defense Evasion Techniques: Uses NTDLL unhooking to remove inline hooks placed by EDR agents, process injection into svchost.exe via thread-context hijacking, and registry-based payload storage to survive reboots.
• Persistence & Recovery Mechanism: Implements a dual-watchdog system—an internal monitor within the injected payload and an external batch script scheduled as a task—that ensures automatic relaunch if either component is terminated, creating a self-healing malware architecture.
• Final Implant: Deploys ValleyRAT (Winos 4.0), a customized Gh0st RAT variant offering C2 communication, command execution, file exfiltration, and screen capture capabilities, communicating with IP address 43.128.26[.]132.

Industry Insight

Organizations must adopt a defense-in-depth strategy that includes monitoring for unusual driver loads, validating digital signatures beyond mere presence, and detecting anomalous behavior in legitimate processes like svchost.exe or ConvertToPDF.exe. Security teams should also prioritize behavioral analysis over signature-based detection, especially when dealing with modular malware exhibiting self-recovery mechanisms, as traditional sandboxing may fail to trigger all stages of such attacks. Additionally, collaboration between threat intelligence providers and cloud service platforms (e.g., Tencent Cloud) could help identify and block early-stage infrastructure used in phishing campaigns before they reach end users.

TL;DR

• Silver Fox 犯罪团伙针对日本制造业组织发动攻击，利用新型驱动漏洞（BYOVD）和 DLL 侧加载技术部署 ValleyRAT 后门。
• 攻击链包含三层驱动框架（BootRepair.sys, EnPortv.sys, wsftprm.sys），实现模块化防御规避与高韧性恢复机制。
• 采用双 Watchdog 设计确保持久化：内部监控注入载荷，外部脚本重启加载器，单点清除难以彻底阻断。
• 结合 NTDLL Unhooking、进程注入、注册表存储及线程劫持等高级技术，提升隐蔽性与抗检测能力。
• 该事件反映 APT 团伙正转向更复杂、可插拔的攻击架构，对工业控制系统安全构成持续威胁。

为什么值得看

本文揭示了国家级网络犯罪组织如何通过组合式攻击链突破传统端点防护边界，尤其对制造业关键基础设施的供应链信任模型提出警示。其模块化设计与多层恢复机制为威胁情报分析与红蓝对抗提供了典型样本，有助于企业构建纵深防御体系。

技术解析

• BYOVD 三驱动框架：首次使用 BootRepair.sys 和 EnPortv.sys 替代此前常用的 amsdk.sys/wsftprm.sys，形成“即插即用”式内核权限获取方案，增强环境适应性。
• DLL 侧加载滥用：利用 Zeon Corporation 合法二进制 ConvertToPDF.exe/PDFDirect.exe 加载恶意 PDFCORE8.dll，绕过应用白名单控制。
• NTDLL Unhooking + Thread Context Hijacking：移除安全软件在用户态设置的 API Hook，并通过劫持 svchost.exe 线程上下文注入 shellcode，实现无文件级驻留。
• 双 Watchdog 恢复架构：内层监测 ValleyRAT 进程存活并自动重建；外层由定时任务触发批处理脚本重新下载并激活 loader，任一组件失效均可触发互补恢复逻辑。
• C2 通信与 payload 存储：通过 registry-based storage 保存加密载荷，连接 IP 43.128.26[.]132 获取动态 shellcode，支持远程指令下发与横向移动扩展。

行业启示

• 零信任架构需延伸至驱动层与系统调用层面：仅依赖终端杀毒或行为分析不足以应对 BYOVD+DLL 侧加载组合拳，应强化签名验证、最小权限原则及内核态异常监控。
• 供应链风险成为重点防护方向：攻击者瞄准第三方合法工具（如 PDF 转换软件）进行污染，建议建立软件物料清单（SBOM）审查机制并对非预期行为实施实时阻断。
• 威胁狩猎应关注“恢复性”而非单纯“入侵性”特征：Watchdog 脚本、计划任务、注册表自启项等持久化痕迹比初始访问更具长期价值，需纳入自动化检测规则库。