SilverFox Hijacks Drivers to Disable Security Tools
Key Takeaways The SilverFox threat group has evolved its attack chain, using DLL sideloading and vulnerable kernel drivers to disable security tools. A recent campaign targeted a Japanese industrial...
Key Takeaways
- The SilverFox threat group has evolved its attack chain, using DLL sideloading and vulnerable kernel drivers to disable security tools.
- A recent campaign targeted a Japanese industrial manufacturer via a fake invoice email.
- The attack delivers ValleyRAT, a remote access Trojan, and employs multiple persistence mechanisms.
- SilverFox leverages legitimate software and signed but vulnerable drivers to evade detection at various stages.
- Defenders must adopt a behavior-focused detection strategy and ensure comprehensive remediation to counter the attack’s resilience.
SilverFox Evolves Tactics to Bypass Security Defenses
The SilverFox threat group has significantly upgraded its operational toolkit, deploying a sophisticated attack chain against a Japanese industrial manufacturer. This updated methodology integrates several evasion techniques, including DLL sideloading and the abuse of signed kernel drivers, to neutralize endpoint security solutions and establish persistent access.
Table Of Content
The infiltration began with a phishing email, masquerading as an invoice, designed to trick the recipient into downloading a ZIP archive from what appeared to be a legitimate hosting service. This initial compromise paved the way for a multi-stage infection process meticulously engineered to bypass conventional security measures.
Hijacking Trusted Software and Kernel Drivers
A critical component of SilverFox’s strategy involves DLL sideloading. This technique allows the attackers to execute malicious code by placing a specially crafted dynamic-link library (DLL) in the same directory as a legitimate, trusted application. When the legitimate program is launched, Windows prioritizes loading the attacker-controlled DLL, enabling the malicious payload to run under the guise of a digitally signed and trusted application. This approach mirrors similar CATO Networks has observed in other campaigns, where signed software is leveraged to conceal malicious loading behaviors.
Once the malicious loader is active, it proceeds to decrypt and install one of several signed yet vulnerable kernel drivers. These drivers grant SilverFox the ability to terminate protected antivirus and endpoint detection and response (EDR) processes from the deepest levels of the Windows operating system. This kernel-level access provides the group with a robust method to circumvent security controls that typical malware would struggle to disable. CATO Networks said in a report shared with Cyber Security News (CSN) that this campaign ultimately delivers ValleyRAT, a remote-access tool, granting attackers full control over compromised systems.
While SilverFox has previously employed a similar strategy of abusing drivers, this iteration introduces two new driver families not previously associated with the group. This expansion provides the attackers with greater flexibility, offering alternative options if a specific driver is blocked or incompatible with a target system, as detailed in the comprehensive analysis by CATO Networks’ report.
A Resilient ValleyRAT Delivery Chain
With security visibility diminished, SilverFox establishes communication with its command-and-control (C2) server. It then downloads shellcode and injects it directly into a suspended legitimate Windows service process. Instead of initiating a new, overtly malicious process, the malware modifies the existing execution path of the suspended service. This ensures that when the service resumes, the injected malicious code runs under the guise of a legitimate system process, further hindering detection.
To further obscure its presence, the malware attempts to restore a clean in-memory copy of a core Windows library. This action can effectively remove certain user-level security hooks, although it does not negate protections afforded by kernel logging, network monitoring, or advanced behavior-based detection systems.
The campaign exhibits robust persistence mechanisms. SilverFox creates a scheduled task to re-execute its loader upon user login. Additionally, a watchdog script continuously monitors the loader’s activity every 30 seconds, restarting it if it becomes inactive. A second monitoring component is also in place, capable of regenerating the injected payload should that process be terminated. This layered approach ensures the malware’s resilience against attempts to remove individual components of the infection chain.
What You Should Do
- Implement Advanced Email Security: Deploy robust anti-phishing solutions that can detect and block malicious attachments and links, even those hosted on seemingly legitimate services.
- Enhance Endpoint Detection: Focus on behavior-based detection rather than relying solely on signatures. Monitor for suspicious DLL loading from temporary folders, vulnerable-driver service creation, suspended Windows processes followed by memory modification, unusual Registry writes, and repeated watchdog activity.
- Patch and Update: Ensure all operating systems, applications, and security software are consistently updated to their latest versions to mitigate known vulnerabilities, especially those related to kernel drivers.
- Isolate and Remediate: Upon detection, immediately isolate affected systems. Conduct a thorough investigation of the full process tree to understand the scope of compromise. Remove all malicious scheduled tasks, driver services, and any other persistence mechanisms.
- Rotate Credentials: Assume compromise of user credentials associated with affected systems and services. Promptly rotate these credentials to prevent further unauthorized access.
- Educate Users: Conduct regular cybersecurity awareness training for employees, emphasizing the dangers of phishing emails and the importance of verifying sender legitimacy before clicking links or downloading attachments.
- Review IoCs: Integrate the provided Indicators of Compromise (IoCs) into your threat intelligence platforms (e.g., MISP, VirusTotal, SIEM) for proactive detection. Remember to defang IP addresses and domains before use in non-controlled environments.
| Type | Indicator | Description |
|---|---|---|
| Domain | file[.]wx2[.]qq[.]com |
Hosted or redirected victims to the invoice-themed archive |
| Domain | hrefbfdhfhgre-1422102728[.]cos[.]ap-hongkong[.]myqcloud[.]com |
Hosted the malicious second-stage component |
| IP address | 43[.]128[.]26[.]132 |
Command-and-control server and shellcode delivery host |
| Network ports | 778, 779 |
Ports stored in the ValleyRAT configuration |
| Registry path | HKCUConsole |
Stores downloaded shellcode as REG_BINARY data |
| Registry path | HKLMSOFTWAREIpDates_sun |
Stores command-and-control configuration |
| Payload marker | FaCai2024 |
Marker used to locate and patch the configuration area |
| File name | PDFCORE8.dll |
Malicious second-stage DLL used for sideloading |
| File name | ConvertToPDF.exe |
Legitimate application abused as a sideloading host |
| File name | PDFDirect.exe |
Legitimate application abused as a sideloading host |
| File name | MicrosoftEdgeUpdate.exe |
Renamed legitimate application used to resemble an update component |
| File name | 20260608154418.zip |
Example timestamp-based archive filename |
| Driver file | BootRepair.sys |
Vulnerable signed driver used for kernel-level process termination |
| Driver file | EnPortv.sys |
Vulnerable signed driver used for kernel-level process termination |
| Driver file | wsftprm.sys |
Vulnerable signed driver associated with CVE-2023-52271 |
| RC4 key | BB7BBB62FD9C76D5DDF37F17DDC3E7FF |
Hardcoded key used to decrypt embedded resources |
| SHA-256 prefix | 01ccc662c4b5d6ff79ede2e5d |
PDFCORE8.dll sample hash prefix reported in the source |
| SHA-256 prefix | 0952f2aacbeb3477b2465dfe3 |
PDFCORE8.dll sample hash prefix reported in the source |
| SHA-256 prefix |
No Comment! Be the first one.