Ethical Hacking News
SilverFox's ValleyRAT campaign showcases the group's mastery of defense-evasion tactics and autonomous AI-driven offensive strategies. As organizations face increasingly complex cyber threats, staying vigilant and adapting to new attack vectors is crucial in protecting against such sophisticated campaigns.
SilverFox targets a Japanese industrial manufacturer with advanced ValleyRAT malware. The attack uses DLL sideloading techniques, kernel drivers, and resilient persistence mechanisms to evade detection. The phishing emails are sent through legitimate QQ and Tencent Cloud services. The malware exploits Windows' dependency resolution mechanisms to load into the system. The malware embeds various components for driver deployment, security-process termination, and thread-context hijacking. The persistence mechanism employs a dual-layer recovery architecture. SilverFox's toolkit is expanding with defense-evasion capabilities. The group uses autonomous AI offensive security agents to enhance attack vectors. The campaign highlights the need for robust security measures to detect and prevent sophisticated attacks.
SilverFox, a sophisticated cyber threat actor, has recently targeted a Japanese industrial manufacturer with an advanced campaign utilizing the ValleyRAT malware. The attack vector employed by SilverFox is particularly noteworthy, as it leverages DLL sideloading techniques, kernel drivers, and resilient persistence mechanisms to evade detection.
The initial stage of the attack involves phishing emails themed around invoices, which are sent to targets through legitimate QQ and Tencent Cloud services. The attackers then exploit vulnerabilities in the ConvertToPDF.exe and PDFDirect.exe applications to sideload malicious DLLs into the system. This technique is remarkable, as it exploits Windows' dependency resolution mechanisms to load the malware.
Upon loading, the malicious DLL, dubbed PDFCORE8.dll, operates as a self-contained execution framework. It embeds several key components within its resources, including BootRepair.sys, EnPortv.sys, and wsftprm.sys, which are used for driver deployment, security-process termination, NTDLL unhooking, and thread-context hijacking.
The malware's persistence mechanism is equally impressive, as it employs a dual-layer recovery architecture. The first layer monitors the activity of the injected svchost.exe process, recreating it if necessary. Meanwhile, an external watchdog, embedded in the DLL's resources, checks for its own presence every 30 seconds and relaunches it if terminated.
Cato CTRL documented this campaign, which highlights SilverFox's expanding toolkit and defense-evasion capabilities. The modular design of PDFCORE8.dll allows it to adapt to various drivers and payloads while maintaining a consistent core framework. This design improves the malware's resilience by enabling it to restore execution even if either the payload or loader is interrupted.
The SilverFox group's use of autonomous AI offensive security agents also warrants attention. By leveraging such capabilities, cybercriminals can significantly enhance their attack vectors and evade detection more effectively.
This campaign serves as a cautionary tale for organizations facing the evolving threat landscape. It underscores the importance of monitoring behavior sequences rather than individual indicators, as the latter may not accurately capture the full scope of an attack. Furthermore, it highlights the need for robust security measures to detect and prevent such sophisticated attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/SilverFoxs-Sophisticated-ValleyRAT-Campaign-A-Masterclass-in-Defense-Evasion-Tactics-ehn.shtml
https://securityaffairs.com/196347/apt/silverfox-targets-japanese-manufacturer-with-advanced-valleyrat-campaign.html
https://thehackernews.com/2026/07/silverfox-targets-japanese-manufacturer.html
Published: Fri Jul 31 02:57:15 2026 by llama3.2 3B Q4_K_M
