SilverFox ValleyRAT Campaign Adds Three BYOVD Drivers to Kill Security Tools
Do Son 
SilverFox infection chain from phishing delivery to ValleyRAT execution | Image: Cato
At a Glance
| Actor / group | SilverFox (Silver Fox), a China-aligned APT tracked since about 2022 |
| Activity type | Targeted malware campaign: phishing, DLL sideloading, and BYOVD delivering ValleyRAT |
| Targets / victims | A Japanese organization in the industrial manufacturing sector |
| Scale | One confirmed victim; three vulnerable drivers; ValleyRAT (Winos 4.0) remote access |
| Status | Not a law-enforcement case; attributed by Cato CTRL with moderate-to-high confidence |
| Source | Cato CTRL analysis; Check Point Research (prior SilverFox BYOVD reporting) |
TL;DR: Cato CTRL analyzed a new SilverFox ValleyRAT campaign against a Japanese manufacturer. The malware hides three signed-but-vulnerable drivers and uses them to shut down security tools from the kernel. It also chains DLL sideloading, NTDLL unhooking, and two recovery layers to stay alive.
What Happened
The attack opens with an invoice-themed phishing email. As the report puts it, “SilverFox is expanding its toolkit.” The lure sends the victim to a ZIP archive hosted on legitimate QQ file-delivery infrastructure. A downloader then pulls the next stage from Tencent Cloud.
That stage drops a malicious PDFCORE8.dll next to a signed application. Two legitimate Zeon Corporation tools, ConvertToPDF.exe and PDFDirect.exe, load the rogue DLL. Windows resolves the dependency from the local folder and runs the attacker’s file instead.
Cato stresses that the trusted binaries stay clean: “the legitimate executables remained digitally signed and were not modified.” The abuse comes from how each app finds the DLL, not from tampering with the signed code.
Three Vulnerable Drivers in One Framework
Inside PDFCORE8.dll sit three signed-but-vulnerable drivers: BootRepair.sys, EnPortv.sys, and wsftprm.sys. Each can terminate protected processes from kernel mode. The loader decrypts them with RC4, installs them as services, and controls them through DeviceIoControl(). CVE-2023-52271 already documents the wsftprm.sys termination abuse.
SilverFox does not commit to one driver. If defenders block a driver, the framework switches to another and reaches the same kernel-level kill. This modular BYOVD design is the campaign‘s headline change.
Layered Evasion and Recovery
The loader does more than deploy drivers. It restores a clean copy of ntdll.dll from disk to strip user-mode hooks. It rebuilds sensitive library names at runtime and resolves APIs only when needed. It then injects shellcode into a suspended svchost.exe through thread-context hijacking.
Two recovery layers keep the malware alive. An internal monitor recreates the injected payload. An external batch watchdog checks the loader every 30 seconds and restarts it. Therefore, killing one piece may not end the intrusion.
Who Is Behind It
Cato CTRL links the activity to SilverFox, a China-aligned group tracked since about 2022. The report states its confidence plainly: “We assess with moderate-to-high confidence that this activity is linked to SilverFox.” The call rests on ValleyRAT use, BYOVD termination, the FaCai2024 marker, and matching victimology. No single clue is treated as proof.
SilverFox has abused vulnerable drivers before. In earlier work, Check Point Research documented a dual-driver framework built around a WatchDog Antimalware driver. This campaign adds two fresh driver associations, BootRepair.sys and EnPortv.sys.
Impact and Scale
The confirmed target is one Japanese organization in industrial manufacturing. The final payload is ValleyRAT, also known as Winos 4.0. It grants remote access, command execution, and further post-compromise control.
The kernel kill switch is the core threat. The user-mode component finds a security process, then hands its PID to a vulnerable driver. The driver calls ZwTerminateProcess() and ends the protected process. This path can defeat EDR and antivirus that block user-mode termination.
One detail limits this specific case. Cato reported that “The Cato SASE Platform blocked the malicious PDFCORE8.dll before ValleyRAT could establish remote access.” Victims without such controls may not be as lucky.
What Comes Next and How to Stay Protected
Vulnerable-driver abuse keeps climbing, so act early. Turn on Microsoft’s Vulnerable Driver Blocklist. Watch for new kernel services and driver loads tied to BootRepair.sys, EnPortv.sys, or wsftprm.sys.
Next, treat DLL sideloading as a first-class risk. Alert when signed apps load DLLs from user-writable folders. Block invoice-themed lures, and inspect delivery traffic to QQ and Tencent Cloud endpoints.
Finally, hunt for the recovery layers. Look for a scheduled task that relaunches a loader and a cmd.exe watchdog on a 30-second loop. For the full indicators, read the Cato CTRL analysis. This SilverFox ValleyRAT campaign shows how one modular framework can blend kernel attacks, evasion, and self-healing into a single chain.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
