A recent cyberattack attributed to the SilverFox group has targeted a Japanese industrial manufacturer, employing sophisticated techniques to infiltrate systems and deploy the ValleyRAT malware. The attackers initiated the campaign by sending a deceptive email containing a fake invoice, enticing the recipient to download a ZIP archive from what appeared to be a legitimate source.
Upon extraction, the archive contained a legitimate PDF-related application alongside a malicious dynamic link library (DLL). This setup exploited a method known as DLL sideloading, where the trusted application inadvertently loads the malicious DLL, allowing the malware to execute under the guise of legitimate software. This technique enables attackers to blend harmful code into normal Windows operations, effectively evading detection.
Once activated, the malicious loader decrypts and installs signed but vulnerable kernel drivers. These drivers possess the capability to terminate protected antivirus and endpoint security processes at the kernel level, thereby disabling critical security measures and facilitating the deployment of ValleyRAT. This remote access tool grants attackers extensive control over the compromised system, including the ability to execute commands, exfiltrate data, and maintain persistent access.
To ensure the malware’s resilience, SilverFox implements multiple persistence mechanisms. A scheduled task is created to rerun the loader upon user logon, while a watchdog script monitors the loader’s activity, restarting it every 30 seconds if necessary. Additionally, the malware injects code into a suspended Windows service process, altering its execution path to run the injected code upon resumption. This approach minimizes the likelihood of detection by security tools.
Defenders are advised to monitor for specific indicators of compromise, such as suspicious DLL loading from temporary folders, creation of services associated with vulnerable drivers, modifications to suspended Windows processes, unusual registry writes, and repeated watchdog activities. Focusing on these behavioral patterns can enhance detection and mitigation efforts against such sophisticated attacks.
The SilverFox group’s ability to exploit trusted software and kernel drivers underscores the evolving nature of cyber threats. Organizations must remain vigilant, adopting comprehensive security strategies that include behavioral analysis and anomaly detection to effectively counteract these advanced persistent threats.
