"In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate applications for DLL sideloading, defense evasion, and layered recovery mechanisms to keep ValleyRAT running," Cato Networks researchers Shani Kurtzberg, Tomer Pugach, Dr. Guy Waizel, Zohar Buber, Idan Tarab, and Shani Kurtzberg said in an analysis.
Invoice lures delivered via QQ and Tencent Cloud trigger DLL sideloading
Cato Networks traces the intrusion against a Japanese organization in the industrial manufacturing sector to an invoice-themed phishing lure that hosts attacker-controlled content on legitimate QQ and Tencent Cloud services. The initial package is a ZIP archive containing a downloader executable; that downloader retrieves the next-stage components needed to perform DLL side-loading from attacker-controlled Tencent Cloud infrastructure.
The malicious DLL used in the sideloading chain is named PDFCORE8.dll and is invoked by legitimate-looking binaries — ConvertToPDF.exe or PDFDirect.exe — turning a common document-conversion workflow into an entry point for deeper compromise.
Three-driver BYOVD framework: BootRepair.sys, EnPortv.sys, and wsftprm.sys
The campaign builds a modular bring-your-own-vulnerable-driver (BYOVD) framework by embedding multiple vulnerable drivers inside PDFCORE8.dll. Cato reports that the DLL contains BootRepair.sys and EnPortv.sys — drivers not previously publicly linked to earlier Silver Fox waves — alongside wsftprm.sys, a driver the group has used before.
Both legitimate binaries used for DLL sideloading are associated with Zeon Corporation, and the inclusion of three different drivers is deliberate: it creates operational resilience and a plug‑and‑play BYOVD system that allows operators to swap drivers while keeping the rest of the workflow intact, Cato says.
Dual watchdog recovery, NTDLL unhooking, and thread‑context hijacking
The loader delivered by the sideloaded DLL acts as a self-contained execution framework. It performs NTDLL unhooking to remove user‑mode inline hooks placed by endpoint security products and embeds layered recovery mechanisms. Cato describes a paired watchdog design: an internal routine that monitors the injected payload and an external watchdog batch script that monitors the loader itself.
The external watchdog installs persistence via a scheduled task and contacts an external server at 43.128.26[.]132 to fetch shellcode. That shellcode is injected into a newly created svchost.exe process using thread‑context hijacking. Cato warns that "This layered design increases resilience because defenders must interrupt both components and prevent either from restoring the other stage."
ValleyRAT (aka Winos 4.0) as the final-stage implant
The final-stage implant installed and protected by this chain is ValleyRAT, a Gh0st RAT variant that provides persistent remote access. Cato characterizes ValleyRAT's capabilities as including command‑and‑control communication, task execution, and additional post‑compromise functions. The attack uses a combination of DLL sideloading, process injection, registry-based payload storage, and the three-driver BYOVD framework to impair security controls and maintain execution.
What this means for security teams, procurement leaders, and the targeted manufacturer
- Security teams: Watch for invoice-themed lures that reference QQ or Tencent Cloud hosts, the presence of ConvertToPDF.exe/PDFDirect.exe loading PDFCORE8.dll, the deployment of BootRepair.sys, EnPortv.sys, or wsftprm.sys, scheduled tasks paired with external watchdog scripts, and traffic to 43.128.26[.]132. Cato's analysis highlights coordinated recovery mechanisms that can recreate either the injected payload or the loader if one component is removed.
- Procurement leaders: The campaign underscores the operational risk of legitimate but vulnerable drivers being repurposed as BYOVD components. The inclusion of multiple drivers to preserve operational flexibility suggests adversaries will continue to mix and match vendors' drivers as part of modular toolchains.
- The targeted Japanese manufacturer: The use of invoice-themed phishing and commodity document conversion binaries indicates the attackers tailored a supply‑chain‑adjacent lure to reach industrial manufacturing operations, then escalated to kernel access and persistent remote access via ValleyRAT.
Silver Fox continues to expand its arsenal beyond ValleyRAT. Cato notes the group has been refining tools such as Atlas RAT (aka AtlasCross RAT), RomulusLoader, and SilentRunLoader while also using tax-themed lures to deliver Gh0st RAT and DCRat. Separately, a South Korean cybersecurity company reported that a 180‑day retrohunt of VirusTotal yielded 146 unique Atlas RAT samples across six PDB builds, two development environment usernames, and 27 heuristic lineages, and observed that "such scale and diversity are inconsistent with management by a single operator," although the company said the link to Silver Fox is circumstantial and insufficient to draw a firm conclusion.
The campaign described by Cato Networks demonstrates a layered, modular approach: multiple vulnerable drivers for kernel access, DLL sideloading through legitimate binaries, unhooking of NTDLL to blind endpoint monitoring, and a two‑pronged watchdog recovery that can restore either the payload or its loader. That combination makes a single remediation step unlikely to be decisive; defenders will need to identify and neutralize multiple coordinated components to disrupt the intrusion.
