SilverFox’s New Tactic: A Three-Driver Assault
The Chinese-speaking cybercrime crew known as SilverFox has shifted gears. Instead of relying on a single vulnerable driver, they’re now chaining three different ones in a bring your own vulnerable driver (BYOVD) attack. The target? A Japanese organization in the industrial manufacturing sector. The goal? Dropping ValleyRAT (also tracked as Winos 4.0) for persistent remote access.
This isn’t just another malware campaign. It’s a deliberate evolution in technique, combining newly observed vulnerable-driver abuse with abuse of legitimate software—a mix that makes detection significantly harder.
How the BYOVD Chain Works
In this campaign, SilverFox leverages a trio of drivers to bypass security controls. Each driver serves a specific purpose: one to disable or tamper with endpoint protection, another to gain kernel-level privileges, and a third to maintain stealth. The chain is designed to work in sequence, with each step paving the way for the next.
- Driver 1: Disables security software (anti-virus, EDR).
- Driver 2: Elevates privileges to kernel mode.
- Driver 3: Provides persistence or hides malicious activity.
Once the drivers do their job, the attackers drop ValleyRAT—a remote access trojan that gives them full control over the infected machine. ValleyRAT isn’t new, but its delivery via a three-driver BYOVD chain is a notable escalation.
Why Target a Japanese Manufacturer?
Industrial manufacturing is a high-value target. These organizations often run legacy systems, have high uptime requirements, and can’t afford downtime for security patches. That makes them attractive to cybercriminals seeking long-term access for data theft, ransomware staging, or industrial espionage.
SilverFox has a history of targeting East Asian entities, but this specific focus on a Japanese manufacturer suggests either a strategic shift or a tailored operation. The use of ValleyRAT—a tool commonly associated with Chinese-speaking threat actors—reinforces the group’s profile.
BYOVD Attacks: A Growing Trend
BYOVD attacks aren’t new, but they’re becoming more common. The technique exploits signed, legitimate drivers that have known vulnerabilities. Attackers load these drivers to perform privileged operations that would otherwise be blocked.
What’s concerning here is the multi-driver approach. Most BYOVD attacks use a single driver. Chaining three suggests a more sophisticated operation, likely with custom tooling or at least careful planning. It also complicates mitigation—blocking one driver isn’t enough if two others can still be abused.
Defending Against Multi-Driver BYOVD
For defenders, the key is layered protection. Relying on a single security control is no longer viable. Here are some practical steps:
- Maintain an up-to-date blocklist of known vulnerable drivers.
- Use memory integrity and virtualization-based security (VBS) to prevent driver loading.
- Monitor for unusual driver load events in your SIEM.
- Segment networks to limit lateral movement post-compromise.
These measures won’t stop every attack, but they raise the bar significantly.
ValleyRAT: More Than Just a Backdoor
ValleyRAT, also known as Winos 4.0, is a feature-rich trojan. It supports keylogging, screen capture, file exfiltration, and command execution. In this campaign, it’s used for persistent remote access—meaning the attackers can return anytime they want.
The malware is often delivered via phishing emails or exploit kits, but the BYOVD chain here adds a layer of sophistication. It’s a reminder that even known malware can be dangerous when paired with novel delivery mechanisms.
What This Means for Industrial Security Teams
If you’re in manufacturing, this is a wake-up call. The attackers aren’t just targeting IT systems; they’re after operational technology (OT) and intellectual property. A successful breach could mean stolen designs, disrupted production, or worse.
Security teams should review their driver policies, audit existing allowlists, and ensure that endpoint protection is configured to detect anomalous driver behavior. Regular threat hunting for ValleyRAT indicators is also advisable.
For more on related threats, check out our analysis of ValleyRAT malware delivery methods and BYOVD attack mitigation strategies.
Final Thoughts
SilverFox’s three-driver BYOVD chain is a clear signal: cybercriminals are getting more creative with their toolkits. The attack on the Japanese manufacturer shows that no sector is off-limits, and no single defense is sufficient.
Staying ahead requires vigilance, continuous monitoring, and a willingness to adapt. The threat landscape is evolving—are your defenses keeping pace?
