SilverFox Hijacks Trusted Software and Kernel Drivers to Disable Security Tools

SilverFox has expanded its malware toolkit in a campaign that targeted a Japanese industrial manufacturer.

The attackers used a fake invoice email to lure a recipient into downloading a ZIP archive hosted through services that normally appear legitimate.

The attack then used trusted software to load a malicious component without changing the signed application itself.

This method, known as DLL sideloading, lets attackers blend harmful code into ordinary Windows activity, much like the techniques seen in this AsyncRAT DLL sideloading campaign.

Analysts at CATO Networks identified the activity and linked it to SilverFox with moderate-to-high confidence.

CATO Networks said in a report shared with Cyber Security News (CSN) that the campaign ultimately delivers ValleyRAT, a remote-access tool that can give attackers control of an infected computer.

The operation matters because it combines several ways of avoiding detection into one chain.

SilverFox can weaken security products, inject code into a trusted Windows process, save its payload in the Registry, and restore parts of the infection if defenders stop only one stage.

SilverFox Hijacks Trusted Software

The attackers pair a legitimate PDF-related application with a malicious library placed in the same folder.

When the trusted program starts, Windows loads the attacker-controlled library first, allowing the malware to run under the cover of valid digital signatures.

This approach resembles the abuse described in recent signed software attacks, where legitimate applications were used to hide malicious loading behavior.

In the SilverFox case, the legitimate applications were not altered, and there is no indication their developer knowingly participated in the activity.

Once active, the malicious loader decrypts and installs one of several signed but vulnerable kernel drivers.

These drivers can terminate protected antivirus and endpoint-security processes from the deepest level of Windows, giving SilverFox a route around controls that ordinary malware may struggle to disable.

The group has used this broad strategy before, including in earlier Silver Fox driver abuse. What is new here is the addition of two driver families not previously tied publicly to the group, creating more options if one driver is blocked or incompatible.

A Resilient ValleyRAT Delivery Chain

After reducing security visibility, SilverFox contacts its command server and injects downloaded shellcode into a suspended Windows service process.

Rather than launching a clearly separate malicious process, it changes the process’s existing execution path so the injected code runs when Windows resumes it.

The malware also attempts to reduce monitoring by restoring a clean in-memory copy of a core Windows library.

That step may remove some user-level security hooks, though it does not eliminate protection from kernel logging, network monitoring, or behavior-based detection.

Persistence is built into the campaign. SilverFox creates a scheduled task to rerun its loader after a user logs on, while a watchdog script checks every 30 seconds whether the loader remains active and restarts it if necessary.

A second monitor can recreate the injected payload if that process is stopped. Defenders should look for the sequence rather than relying on a single filename, domain, or signature.

Useful signals include suspicious DLL loading from temporary folders, vulnerable-driver service creation, a suspended Windows process followed by memory modification, unusual Registry writes, and repeated watchdog activity.

This behavior-focused approach is especially important in ValleyRAT fake VLC attacks, where trusted-looking applications also help conceal delivery.

Security teams should isolate affected systems quickly, investigate the full process tree, remove malicious scheduled tasks and driver services, and rotate credentials that may have been exposed during remote access.

Blocking a single component may not be enough if the remaining recovery mechanism can rebuild the infection chain.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world