A sophisticated cyberattack has been identified targeting a Japanese industrial manufacturing company, orchestrated by the Chinese cybercrime group known as Silver Fox. This operation employs a complex ‘bring your own vulnerable driver’ (BYOVD) technique to deploy the ValleyRAT malware, also referred to as Winos 4.0, ensuring persistent remote access to the compromised systems.
The attack initiates with a phishing email disguised as an invoice, enticing recipients to download a ZIP archive. This archive contains a downloader executable that retrieves additional components from attacker-controlled Tencent Cloud infrastructure. These components facilitate a DLL side-loading process, a method where malicious DLL files are loaded by legitimate applications to evade detection.
In this campaign, Silver Fox introduces two previously unreported vulnerable drivers, ‘BootRepair.sys’ and ‘EnPortv.sys,’ alongside the known ‘wsftprm.sys.’ These drivers are embedded within a malicious DLL (‘PDFCORE8.dll’) sideloaded by legitimate Zeon Corporation binaries such as ‘ConvertToPDF.exe’ or ‘PDFDirect.exe.’ This three-driver BYOVD framework enhances the malware’s ability to disable security controls and maintain persistence on the infected host.
To further evade detection, the malware employs NTDLL unhooking, a technique that removes monitoring hooks placed by security software on native Windows API functions. Additionally, it utilizes process injection and registry-based payload storage to execute and conceal its activities.
A notable feature of this attack is its dual watchdog mechanism designed to ensure the malware’s resilience. An internal routine monitors the injected payload, while an external batch script oversees the loader responsible for deploying the payload. If either component is terminated, the other reinitiates the attack sequence, complicating remediation efforts.
ValleyRAT, the final-stage implant, is a variant of the Gh0st RAT malware family. It provides the attackers with comprehensive remote access capabilities, including command execution and further post-compromise activities, thereby posing a significant threat to the targeted organization’s security and operational integrity.
This incident underscores the evolving sophistication of cyber threats targeting industrial sectors. Organizations must remain vigilant, adopting robust security measures and fostering a culture of cybersecurity awareness to defend against such advanced persistent threats.
