SilverFox’s New Tactic: A Three-Driver Assault

The Chinese-speaking cybercrime crew known as SilverFox has shifted gears. Instead of relying on a single vulnerable driver, they’re now chaining three different ones in a bring your own vulnerable driver (BYOVD) attack. The target? A Japanese organization in the industrial manufacturing sector. The goal? Dropping ValleyRAT (also tracked as Winos 4.0) for persistent remote access.

This isn’t just another malware campaign. It’s a deliberate evolution in technique, combining newly observed vulnerable-driver abuse with abuse of legitimate software—a mix that makes detection significantly harder.

How the BYOVD Chain Works

In this campaign, SilverFox leverages a trio of drivers to bypass security controls. Each driver serves a specific purpose: one to disable or tamper with endpoint protection, another to gain kernel-level privileges, and a third to maintain stealth. The chain is designed to work in sequence, with each step paving the way for the next.

• Driver 1: Disables security software (anti-virus, EDR).
• Driver 2: Elevates privileges to kernel mode.
• Driver 3: Provides persistence or hides malicious activity.

Once the drivers do their job, the attackers drop ValleyRAT—a remote access trojan that gives them full control over the infected machine. ValleyRAT isn’t new, but its delivery via a three-driver BYOVD chain is a notable escalation.

Why Target a Japanese Manufacturer?

Industrial manufacturing is a high-value target. These organizations often run legacy systems, have high uptime requirements, and can’t afford downtime for security patches. That makes them attractive to cybercriminals seeking long-term access for data theft, ransomware staging, or industrial espionage.

SilverFox has a history of targeting East Asian entities, but this specific focus on a Japanese manufacturer suggests either a strategic shift or a tailored operation. The use of ValleyRAT—a tool commonly associated with Chinese-speaking threat actors—reinforces the group’s profile.

BYOVD Attacks: A Growing Trend

BYOVD attacks aren’t new, but they’re becoming more common. The technique exploits signed, legitimate drivers that have known vulnerabilities. Attackers load these drivers to perform privileged operations that would otherwise be blocked.

What’s concerning here is the multi-driver approach. Most BYOVD attacks use a single driver. Chaining three suggests a more sophisticated operation, likely with custom tooling or at least careful planning. It also complicates mitigation—blocking one driver isn’t enough if two others can still be abused.

Defending Against Multi-Driver BYOVD

For defenders, the key is layered protection. Relying on a single security control is no longer viable. Here are some practical steps:

• Maintain an up-to-date blocklist of known vulnerable drivers.
• Use memory integrity and virtualization-based security (VBS) to prevent driver loading.
• Monitor for unusual driver load events in your SIEM.
• Segment networks to limit lateral movement post-compromise.

These measures won’t stop every attack, but they raise the bar significantly.

ValleyRAT: More Than Just a Backdoor

ValleyRAT, also known as Winos 4.0, is a feature-rich trojan. It supports keylogging, screen capture, file exfiltration, and command execution. In this campaign, it’s used for persistent remote access—meaning the attackers can return anytime they want.

The malware is often delivered via phishing emails or exploit kits, but the BYOVD chain here adds a layer of sophistication. It’s a reminder that even known malware can be dangerous when paired with novel delivery mechanisms.

What This Means for Industrial Security Teams

If you’re in manufacturing, this is a wake-up call. The attackers aren’t just targeting IT systems; they’re after operational technology (OT) and intellectual property. A successful breach could mean stolen designs, disrupted production, or worse.

Security teams should review their driver policies, audit existing allowlists, and ensure that endpoint protection is configured to detect anomalous driver behavior. Regular threat hunting for ValleyRAT indicators is also advisable.

For more on related threats, check out our analysis of ValleyRAT malware delivery methods and BYOVD attack mitigation strategies.

Final Thoughts

SilverFox’s three-driver BYOVD chain is a clear signal: cybercriminals are getting more creative with their toolkits. The attack on the Japanese manufacturer shows that no sector is off-limits, and no single defense is sufficient.

Staying ahead requires vigilance, continuous monitoring, and a willingness to adapt. The threat landscape is evolving—are your defenses keeping pace?

The Cheap TV Stick That’s Actually a Click-Farming Bot

You see them on Amazon for $30 or $40. They promise free movies, live sports, and endless channels — no subscription needed. They’re called H96 streaming sticks, and they look like a bargain. But a new investigation from security firm Bitsight TRACE reveals these devices aren’t just a privacy risk. They’re part of a sophisticated ad fraud network that turns your living room into a cash machine — for someone else.

Researcher Pedro Falé bought an expired domain once used by thousands of H96 boxes for telemetry. What he found inside was a sprawling operation. The devices weren’t just streaming Netflix. They were masquerading as Samsung, Vivo, Huawei, and Xiaomi smartphones, clicking ads on AI-generated websites. “Multiple devices reporting to this factory Android TV Box backdoor were ‘phones,’” Falé said. “Something was wildly wrong.”

This is the story of how a cheap TV streaming stick ad fraud network works — and why you should think twice before plugging one in.

How H96 Devices Fake Being Phones

Bitsight TRACE tracked roughly 38,000 H96 boxes worldwide phoning home to that expired domain. Each device reported its hardware specs and a full list of installed apps. But the data showed something odd: every box claimed to be a mobile phone model from a major manufacturer. The same two apps were installed on all of them, both made by a Chinese company called Zhejiang Fengwo IoT Technology Ltd, operating under the Fengwo Group.

Falé dug deeper. He found that Fengwo Group had registered patents matching the apps’ behavior. The apps coordinate a network where H96 devices serve as “captive traffic sources.” They visit websites — also run by Fengwo — that only display ads when the visitor matches a spoofed mobile profile. The boxes click those ads, generating revenue from advertisers who think they’re reaching real people on phones.

The websites themselves are bizarre. Bitsight found machine-generated news articles on finance, health, education, gaming, and food blogs. No human wrote them. AI did. And the sites only show ads to the spoofed devices. To a normal browser, they appear ad-free.

Blockly: The Drag-and-Drop Malware Factory

Fengwo Group’s homepage claims it has created more than 120,000 “AI digital humans” for rent — for companionship, customer service, or creative design. Bitsight’s report suggests this might be a cover story. But the real ingenuity lies in how the fraud is built.

The group uses a Google-built visual programming language called Blockly, originally designed to teach kids to code. Fengwo’s employees drag and drop code blocks in a Blockly editor to define fraud routines. “An operator doesn’t need as much understanding of the underlying technicalities,” Bitsight’s report notes. “Only a small number of highly-skilled developers are needed to build the template execution-unit images.”

When an H96 box is selected for a task, it receives the appropriate Blockly module. That module can silently launch a browser, visit pages, manage tabs, and click ads. The system fuses three vision and reasoning systems into one interface, letting bots identify ads on a page and navigate like a human. It’s ad fraud made easy — no coding skills required.

When Your TV Is On, Your Internet Is for Rent

Bitsight discovered a chilling pattern. When the H96 box detects an HDMI signal — meaning you’re watching something — it switches to residential proxy mode. That means it rents your home’s IP address to strangers: content scrapers, ticket scalpers, even cybercriminals. When the TV is off, the box flips back to ad fraud mode, waiting for its next click job.

Falé believes the device is designed this way because ad fraud tasks are resource-heavy and would interfere with streaming video. So the box only runs fraud when you’re not using it. But the proxy software runs whenever the TV is on. Either way, your network is being used without your knowledge.

These devices are also notoriously insecure. They ship with no authentication, default passwords, and outdated Android builds. In January, the proxy tracking service Synthient documented how botnets enslaved millions of TV boxes by exploiting vulnerabilities in both the proxy software and the hardware itself. Plug one in, and you’re inviting attackers onto your network.

The $50,000-a-Day Business Model

Bitsight estimates the Fengwo Group’s ad fraud network generates close to $50,000 per day — and that’s from just one old domain. The actual revenue, including the residential proxy side, could be much higher. “These estimates are highly conservative,” Falé said.

Despite repeated warnings from the FBI and security firms, major e-commerce platforms like Amazon, Best Buy, and Newegg continue to sell hundreds of models that bundle unofficial Android versions. They’re marketed by influencers as a way to stream premium content for free. But the real cost is your privacy, your network security, and your bandwidth.

Fengwo Group did not respond to requests for comment. Emails to its contact address bounced back with a message that the inbox was full — or “getting too much mail right now.”

How to Protect Yourself

The safest move is simple: stick to name-brand streaming devices from reputable manufacturers. Google provides a way to check if a device is certified for Android TV OS and Play Protect. Synthient also maintains a list of IoT devices known to ship with pre-installed proxy software and malicious apps. That list includes not just streaming sticks but also digital photo frames — another popular category the FBI has flagged.

Even with a trusted device, be careful what apps you install. Many third-party apps bundle residential proxy software. If a deal sounds too good to be true — a $30 stick that unlocks all the world’s TV — it almost certainly is. The real price is your home network, turned into a tool for fraud.

When Trusted Websites Become Weapons

South Korean authorities, alongside four security vendors, have pulled back the curtain on a state-sponsored operation that turned trusted domestic websites into silent delivery systems. The attackers breached legitimate sites, then used them to exploit a widely installed piece of financial-security software. Visitors running a vulnerable version of AnySign4PC could be infected with SIGNBT or COPPERHEDGE backdoors — no prompts, no warnings, no second chances.

The campaign is a stark reminder that cyberattacks don’t always knock on the front door. Sometimes they slip in through the plumbing.

How the AnySign4PC Exploit Works

AnySign4PC is a mainstay of South Korean online banking and government services. It’s the kind of software millions of people install without thinking twice — because, in most cases, they have to. That ubiquity made it a prime target.

The attackers didn’t just hack the software’s vendor. They compromised the websites that host and distribute it. When a user visited a tainted page, the exploit chain fired automatically against vulnerable AnySign4PC installations. The result? A backdoor dropped onto the system with zero user interaction. No phishing email, no malicious attachment, no suspicious link.

Security researchers have tracked these implants as SIGNBT and COPPERHEDGE. Both are remote-access trojans designed to give attackers persistent control. They can steal credentials, capture keystrokes, and move laterally across networks. In the context of South Korea’s financial sector, that’s a serious escalation.

Why This Attack Is Different

Most exploits rely on social engineering. Someone has to click something. This one didn’t. By compromising trusted infrastructure, the attackers turned a routine visit into a potential compromise. That’s the kind of attack that preys on trust — and it works because the victim did everything right.

The campaign also underscores a growing trend: attackers are moving up the supply chain. They’re not just targeting end users; they’re going after the software and infrastructure those users depend on.

Who’s Behind the Campaign?

South Korean authorities have attributed the operation to a state-sponsored group, though they’ve stopped short of naming a specific nation. The four security firms involved — which include domestic and international players — have corroborated the findings. Their reports point to a sophisticated actor with significant resources and a clear focus on espionage.

The choice of targets is telling. Financial software, government-adjacent sites, and backdoors that enable long-term access all suggest a strategic intelligence operation, not a smash-and-grab crime spree.

What You Should Do Right Now

If you’re in South Korea — or you’ve ever used AnySign4PC for banking or government services — here’s your checklist:

• Update AnySign4PC immediately. The vendor has released patches. Check for updates or reinstall the latest version from the official source.
• Scan for indicators of compromise. Look for SIGNBT or COPPERHEDGE signatures. Your antivirus may already detect them — run a full system scan.
• Monitor your accounts. Unusual activity in banking or government portals could signal a breach.
• Check your installed programs. If you see AnySign4PC and haven’t used it recently, consider whether you still need it. Removing unused software reduces your attack surface.

For IT administrators, this is a wake-up call. Audit your software supply chain. Ensure that any third-party tools your organization relies on are patched and monitored. And consider whether your users really need that legacy financial plugin at all.

The Bigger Picture: Supply Chain Attacks Are Rising

This isn’t an isolated incident. Over the past few years, supply chain attacks have become the go-to tactic for advanced persistent threats. From SolarWinds to lesser-known campaigns, attackers have learned that compromising one trusted vendor or site can yield access to thousands of victims.

The supply chain attack risks extend beyond financial software. Any widely deployed utility — VPN clients, update mechanisms, even browser extensions — can be weaponized. The key takeaway is simple: trust is a vulnerability. Organizations need to verify, not just assume, that their software is safe.

For individuals, the advice is less about paranoia and more about hygiene. Keep software updated. Remove what you don’t use. And when a security advisory like this drops, act on it — don’t wait for the next headline.

Final Thoughts

The AnySign4PC hack is a sobering example of how cyber warfare has evolved. The battlefield is no longer just the inbox. It’s the websites you visit, the software you run, and the trust you place in both.

South Korean authorities and security firms have done the right thing by disclosing this campaign. Now it’s up to users and administrators to respond. Patch, scan, and stay vigilant. The next attack might not come with a warning.