A sophisticated cyberattack campaign orchestrated by the group known as SilverFox has been found targeting a Japanese industrial manufacturer. The attackers utilized deceptive emails containing a fake invoice to trick recipients into downloading a seemingly legitimate ZIP archive. Once opened, this archive employed a technique called DLL sideloading, which allowed the attackers to integrate harmful code into routine Windows operations without altering the signed application itself.
Security analysts at CATO Networks discovered the campaign and attributed it to SilverFox with moderate-to-high confidence. Their analysis revealed that the campaign ultimately deploys ValleyRAT, a remote-access tool that grants attackers control over compromised systems. This operation is notably concerning due to its multifaceted approach to evading detection. SilverFox is capable of weakening security products by injecting malicious code into trusted Windows processes, storing payloads in the Windows Registry, and ensuring persistence even if defenders interrupt one stage of the attack.
In this campaign, a legitimate PDF-related application is paired with a malicious library in the same directory. When the trusted application is executed, Windows inadvertently loads the attacker-controlled library first, allowing malicious actions to occur under the guise of valid digital signatures. Notably, the legitimate applications themselves remain untouched, and there is no evidence suggesting that their developers were involved in the campaign.
Once the malicious loader is active, it decrypts and installs vulnerable kernel drivers that can disable antivirus and endpoint security processes at a fundamental level. This strategy provides SilverFox with routes to bypass controls that traditional malware might struggle against. The campaign also introduces two new driver families, expanding the group’s options if one driver is blocked or incompatible.
SilverFox then contacts its command server, injecting shellcode into a suspended Windows process, which subtly alters the process's execution path to ensure the injected code runs seamlessly. The malware further attempts to evade monitoring by restoring a clean in-memory copy of a Windows library, though this does not fully eliminate detection.
Persistence is a key feature of this campaign, as it creates scheduled tasks to rerun its loader upon user logins and employs a watchdog script to keep the loader active. Defenders are advised to monitor for sequences of suspicious activity rather than single indicators like filenames or domains. Key signs include unusual DLL loading, the creation of vulnerable-driver services, and repeated watchdog activities.
For effective response, security teams should swiftly isolate affected systems, thoroughly investigate process trees, remove malicious scheduled tasks and driver services, and rotate any exposed credentials. Relying solely on blocking one component might not suffice, as the infection chain could be rebuilt through other means.