Cato CTRL documented a new SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.
The attack chain starts with an invoice-themed phishing email. The last stage was remote access via ValleyRAT. Everything in between is the interesting part.
“The attack begins with an invoice-themed phishing lure and uses attacker-controlled content hosted through legitimate QQ and Tencent Cloud services. The attackers then abuse ConvertToPDF.exe and PDFDirect.exe to sideload a malicious PDFCORE8.dll.” reads the report published by Cato. “Based on the public research we reviewed, neither application had previously been documented as a DLL-sideloading host.”
Both applications are legitimate products from Zeon Corporation, digitally signed and unmodified. The attack works because Windows resolves DLL dependencies from the local working directory first, so placing a malicious PDFCORE8.dll in the same folder as the trusted executable is enough.
In some samples, the executable was also renamed MicrosoftEdgeUpdate.exe to reduce suspicion further, which at least shows a sense of humor about impersonation targets.
Once loaded, PDFCORE8.dll operates as a self-contained execution framework with all its most dangerous components stored inside as encrypted resources.
“The malicious PDFCORE8.dll embeds BootRepair.sys, EnPortv.sys, and wsftprm.sys and manages them through shared resource-decryption, driver-deployment, service-creation, and device-communication routines.” continues the report. “One of the most significant findings in this campaign is SilverFox’s modular BYOVD framework. Rather than depending on a single signed but vulnerable driver, the malware supports three options: BootRepair.sys, EnPortv.sys, and wsftprm.sys.“
Across variants, the malware mainly changes the driver image, device name, and IOCTL value while reusing the same core framework.
The practical implication of this modular design is that blocking one driver doesn’t stop the attack, the framework simply tries another. BootRepair.sys and EnPortv.sys are both new associations for SilverFox; wsftprm.sys appeared in prior reporting on the group.
All three drivers ultimately serve the same purpose: getting a process identifier into kernel space and calling ZwTerminateProcess() on security products that user-mode processes can’t touch. The user-mode component enumerates running processes, matches them against a hardcoded list of endpoint security tools, and passes the PIDs to whichever driver is loaded. The driver handles the actual kill from kernel mode. The malware also unhooks NTDLL by replacing its in-memory .text section with a clean copy from disk, removing inline monitoring hooks before calling native Windows APIs.
After terminating security processes and cleaning up API hooks, the malware contacts its C2 at 43.128.26[.]132, downloads shellcode, injects it into a suspended svchost.exe process via thread-context hijacking, and stores both the shellcode and its configuration in the registry, under HKCU\Console\0 and HKLM\SOFTWARE\IpDates_sun respectively.
“Before executing the registry-resident shellcode, the malware searches it for the marker: FaCai2024 The marker does not represent executable instructions. Instead, it identifies a reserved region inside the payload where the malware inserts its runtime configuration.” continues the report. “The framework retrieves the configuration from: HKLM\SOFTWARE\IpDates_sun It then replaces the FaCai2024 placeholder with the recovered C2 information, producing a fully configured payload immediately before execution. This separation gives the attacker operational flexibility. The same stored payload can be reused with updated server addresses or ports without changing the payload body itself.”
“Fa Cai” means “become prosperous” in Mandarin. Tencent Security previously documented the same marker and registry location in earlier FaCai phishing group activity.
The recovery architecture is what makes this campaign notably harder to disrupt than typical malware deployments. An internal monitoring routine checks every cycle whether the injected svchost.exe process is still active, and recreates the payload if it isn’t. An external watchdog, a batch script embedded in the DLL’s resources and executed via cmd.exe, checks every 30 seconds whether the loader itself is still running, and relaunches it if not. Defenders who terminate only the injected payload leave the loader running to recreate it.
Defenders who terminate only the loader leave the watchdog running to restart it. Both components need to go simultaneously, and then the scheduled task that relaunches the loader on logon needs to go too.
Detection should focus on behavior sequences rather than individual indicators. ConvertToPDF.exe or PDFDirect.exe executing from %TEMP%, kernel-driver services for any of the three embedded drivers appearing, binary data written to HKCU\Console\0, and tasklist.exe or find.exe running repeatedly from cmd.exe are each individually explainable — together they describe this specific attack chain. Cato’s NGAM blocked the malicious PDFCORE8.dll before the driver deployment stage was reached in the observed incident, which cut the chain at its most central point since the DLL contains every subsequent capability the attack depends on.
“This campaign shows how SilverFox is expanding its defense-evasion and remote-access toolkit. The most significant additions are the previously undocumented SilverFox use of BootRepair.sys and EnPortv.sys, along with the abuse of ConvertToPDF.exe and PDFDirect.exe as DLL-sideloading hosts.” concluders the report. “The malicious PDFCORE8.dll brings these capabilities together in one modular stage that combines vulnerable-driver deployment, security-process termination, NTDLL unhooking, thread-context hijacking, registry-based payload storage, and dual recovery mechanisms. This design improves resilience by allowing the malware to restore execution if either the payload or loader is interrupted.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SilverFox APT)