Listen to this Post
Introduction, A New Generation of Cyber Espionage Emerges
Cybercriminal groups continue to refine their techniques, but every so often a campaign appears that demonstrates a noticeable leap in operational maturity. Security researchers at Cato CTRL recently uncovered one such operation, documenting a new SilverFox campaign targeting a Japanese industrial manufacturer. Rather than relying on simple malware deployment, the attackers built a highly resilient, multi-stage intrusion capable of surviving defensive actions and restoring itself automatically after partial removal.
What makes this campaign particularly alarming is not simply the final malware payload, ValleyRAT, but the carefully engineered infection chain leading to it. The attackers abused legitimate software, deployed multiple vulnerable kernel drivers, manipulated Windows internals, and implemented layered persistence mechanisms designed to frustrate incident responders. Every stage appears carefully planned to maximize stealth while minimizing the chances of complete eradication.
The operation highlights how modern Advanced Persistent Threat (APT) groups increasingly combine trusted software, Windows kernel exploitation, and modular malware architecture into attacks that can bypass conventional endpoint protection. Instead of depending on one vulnerable technique, SilverFox now maintains several fallback options, allowing the operation to continue even when defenders successfully interrupt portions of the attack.
A Phishing Email Opens the Door
An Innocent Invoice Becomes the Entry Point
Like many sophisticated cyberattacks, the campaign begins with something remarkably ordinary: an invoice-themed phishing email.
Victims receive what appears to be a legitimate financial document. Instead of directly delivering malware, however, the phishing message retrieves attacker-controlled content hosted on legitimate cloud infrastructure, including QQ and Tencent Cloud services.
Using trusted hosting providers significantly reduces suspicion while making network filtering more difficult.
Trusted Applications Become Malware Launchers
DLL Sideloading Reaches a New Level
After the phishing stage, the attackers exploit two legitimate Zeon Corporation applications:
ConvertToPDF.exe
PDFDirect.exe
Neither executable had previously been documented as a DLL sideloading host.
Since Windows searches the local application directory before system directories when resolving DLL dependencies, attackers simply place a malicious PDFCORE8.dll beside the legitimate executable.
Windows unknowingly loads the malicious library while executing the signed application.
The applications themselves remain completely untouched.
They are digitally signed.
They are genuine.
The compromise exists entirely within the malicious DLL.
Some samples even renamed the executable to MicrosoftEdgeUpdate.exe, attempting to imitate a familiar Windows component and reduce suspicion.
The Malicious PDFCORE8.dll Becomes the Entire Framework
One DLL Controls Everything
Instead of downloading multiple malware modules individually, SilverFox hides nearly every component inside a single encrypted DLL.
PDFCORE8.dll contains encrypted resources responsible for:
Driver deployment
Registry modifications
Persistence
Shellcode execution
Communication routines
Process termination
Recovery scripts
Everything required for the attack exists inside one modular package.
This architecture dramatically simplifies deployment while increasing operational reliability.
SilverFox Expands Its BYOVD Strategy
Multiple Vulnerable Drivers Replace Single Points of Failure
One of the
Instead of depending on one vulnerable signed driver, SilverFox now supports three:
BootRepair.sys
EnPortv.sys
wsftprm.sys
Researchers identified BootRepair.sys and EnPortv.sys as completely new additions to SilverFox operations.
The malware framework can simply switch drivers if one becomes blocked by security software.
Rather than redesigning malware, operators merely substitute another vulnerable driver while keeping the rest of the infrastructure unchanged.
Kernel-Level Process Termination
Attacking Security Software from Ring 0
All three drivers ultimately perform the same task.
The malware first scans running processes for endpoint security products.
After identifying security software, process identifiers (PIDs) are passed into kernel mode.
There, the vulnerable driver invokes ZwTerminateProcess(), allowing protected security products to be forcibly terminated.
Because the attack executes from kernel space rather than user space, many endpoint protections cannot defend themselves.
This significantly weakens host-based defenses before the primary payload is deployed.
Removing Windows Monitoring Hooks
NTDLL Unhooking Eliminates Visibility
SilverFox also restores a clean copy of
Many endpoint detection platforms hook Windows APIs to observe suspicious activity.
By replacing the modified in-memory .text section with an original version from disk, SilverFox removes these monitoring hooks.
Once restored, native Windows API calls execute without many user-mode security products observing them.
This considerably reduces behavioral visibility during the remainder of the infection.
ValleyRAT Finally Arrives
Remote Access Begins
After defensive tools have been weakened, the malware contacts its command-and-control server.
The framework downloads encrypted shellcode.
Rather than launching a new process directly, it performs thread-context hijacking.
A suspended svchost.exe process becomes the execution host.
The shellcode then executes inside this trusted Windows process, helping the malware blend into legitimate system activity.
Registry-Based Payload Storage
Living Beyond Files
Instead of leaving malware on disk where antivirus solutions can easily locate it, SilverFox stores both shellcode and configuration inside the Windows Registry.
Examples include:
HKCUConsole0
HKLMSOFTWAREIpDates_sun
This fileless approach complicates forensic investigations and reduces traditional antivirus detection opportunities.
The Meaning Behind FaCai2024
A Hidden Configuration Marker
Researchers discovered an unusual string embedded within the shellcode:
FaCai2024
Rather than executable code, it serves as a placeholder.
Before execution, malware retrieves configuration information from the registry and replaces the placeholder with current C2 information.
This clever separation allows attackers to reuse the same shellcode while updating servers or ports without recompiling malware.
Interestingly, “Fa Cai” translates roughly to “become prosperous” in Mandarin and has appeared in earlier phishing campaigns previously attributed to related activity.
A Dual Recovery Architecture Makes Removal Difficult
Two Independent Recovery Systems
Most malware depends upon a single persistence mechanism.
SilverFox introduces two.
The first continuously monitors the injected svchost.exe payload.
If defenders terminate the process, the loader automatically recreates it.
The second mechanism is even more dangerous.
An embedded batch script executes through cmd.exe, checking approximately every thirty seconds whether the loader itself remains active.
If defenders terminate only the loader, the watchdog immediately restarts it.
Even after both components disappear, a scheduled Windows task recreates the loader during the next logon.
Incident responders must eliminate every persistence layer simultaneously.
Missing only one component allows the entire attack to recover.
Detection Requires Behavioral Correlation
Single Indicators Are Not Enough
Traditional Indicators of Compromise (IOCs) become far less useful against modular malware.
Instead, defenders should monitor combinations of suspicious behavior, including:
ConvertToPDF.exe or PDFDirect.exe executing from %TEMP%
Unexpected kernel driver service creation
Registry modifications under HKCUConsole0
Frequent execution of tasklist.exe
Repeated use of find.exe
DLL sideloading behavior
Registry-resident shellcode
Thread-context hijacking
Each action individually may appear benign.
Together they form the unique behavioral fingerprint of this SilverFox campaign.
Why This Campaign Matters
SilverFox Is Becoming More Dangerous
The discovery demonstrates an important evolution.
SilverFox is no longer deploying ordinary remote-access malware.
It is building resilient attack ecosystems capable of surviving defensive intervention.
Multiple drivers.
Multiple recovery mechanisms.
Registry persistence.
Kernel privilege abuse.
Trusted executables.
All combined into one modular framework.
This represents a significant increase in operational sophistication compared to earlier campaigns.
Deep Analysis
Technical Breakdown of the Attack Chain
Initial Investigation Commands
Get-Process tasklist wmic process list full
These commands help investigators identify suspicious parent-child process relationships involving ConvertToPDF.exe, PDFDirect.exe, and svchost.exe.
Registry Inspection
reg query HKCU\Console reg query HKLM\SOFTWARE\IpDates_sun
Useful for identifying registry-resident payloads and stored configuration.
Driver Enumeration
driverquery sc query type= driver fltmc
Investigators should compare loaded drivers against known enterprise baselines.
Scheduled Task Analysis
schtasks /query /fo LIST /v
Search for newly created persistence mechanisms.
Network Connections
netstat -ano Get-NetTCPConnection
Useful for identifying outbound communications linked to suspicious processes.
Memory Analysis
procdump -ma svchost.exe
Capturing memory from suspicious svchost.exe instances may reveal injected shellcode.
DLL Verification
Get-AuthenticodeSignature ConvertToPDF.exe Get-FileHash PDFCORE8.dll
Verifies trusted executables while identifying malicious DLL replacements.
Event Log Review
Get-WinEvent -LogName Security
Get-WinEvent -LogName System
Helps correlate process creation, driver installation, and service registration events.
What Undercode Say
SilverFox Demonstrates the Future of Malware Engineering
The most concerning aspect of this campaign is not ValleyRAT itself but the engineering philosophy behind the attack. SilverFox has shifted away from relying on a single exploit or persistence mechanism and instead embraces redundancy at nearly every stage.
Its modular BYOVD implementation is especially significant. By supporting multiple vulnerable drivers, the operators avoid creating a single defensive chokepoint. Security vendors may blacklist one driver today, only for attackers to rotate seamlessly to another tomorrow.
Equally important is the abuse of legitimate software. DLL sideloading through trusted, digitally signed applications continues to be one of the most effective techniques for bypassing traditional application allowlisting. Organizations often trust signed binaries without validating the integrity of adjacent DLLs, creating an ideal opportunity for attackers.
The campaign also demonstrates a deep understanding of Windows internals. NTDLL unhooking, thread-context hijacking, registry-based payload storage, and kernel-assisted process termination are not techniques commonly found in commodity malware. Their combination suggests experienced developers with extensive knowledge of defensive technologies.
Another noteworthy feature is the layered recovery architecture. Many organizations assume malware removal is complete after terminating malicious processes. SilverFox intentionally challenges that assumption by creating mutually dependent recovery components. Unless responders eliminate every persistence mechanism simultaneously, the infection rebuilds itself.
From a defensive perspective, behavioral detection becomes far more valuable than static signatures. The individual indicators observed in this campaign are not unique. However, the sequence of DLL sideloading, vulnerable driver deployment, registry persistence, kernel process termination, and repeated watchdog activity forms a highly recognizable attack pattern.
Security teams should also reconsider the risks posed by legitimate software. Trusted executables frequently become attractive malware hosts because defenders rarely monitor their DLL loading behavior in depth. Strengthening DLL search order protections and implementing application control policies can significantly reduce exposure.
Finally, this campaign reinforces a broader industry trend. Advanced threat actors increasingly prioritize resilience over speed. Instead of simply infecting a system, they design malware ecosystems capable of surviving partial detection, automated remediation, and even manual incident response. Defenders must therefore focus not only on identifying malware but on understanding the relationships between its components and eliminating the entire ecosystem rather than isolated artifacts.
Verification Summary
✅ Security researchers from Cato CTRL documented a new SilverFox campaign targeting a Japanese industrial manufacturer, introducing previously undocumented DLL sideloading hosts and additional vulnerable kernel drivers.
✅ The
✅ There is no evidence that the documented attack relied on a single exploit. Instead, the campaign used multiple complementary techniques to maximize stealth, resilience, and persistence, making defensive behavioral analysis significantly more important than relying solely on static indicators.
Prediction
Future Outlook
(-1) The techniques demonstrated in this SilverFox campaign are likely to spread to other advanced threat groups over the coming months. Expect greater adoption of multi-driver BYOVD frameworks, fileless registry payloads, and layered recovery mechanisms designed to survive incident response. Organizations that continue relying primarily on signature-based detection or isolated indicators of compromise will face increasing difficulty detecting and fully removing these next-generation malware ecosystems.
▶️ Related Video (84% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
