Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks

Cybersecurity: Silver Fox Malware Campaign

Recent investigations have identified a series of targeted malware campaigns attributed to the Silver Fox threat group. These operations predominantly focus on organizations in Asia, utilizing localized tactics to infiltrate systems.

The attackers employ deceptive phishing emails that mimic official communications, such as tax audit notifications and electronic invoice downloads, to distribute the Winos 4.0 malware, also known as ValleyRat. These emails include malicious attachments or embedded links designed to compromise recipient systems.

Upon interaction with these files, an infection chain is initiated, designed to operate discreetly and evade immediate detection.

Successful infections result in significant file encryption and data theft, potentially enabling further cyberattacks. Traditional static domain blocking is largely ineffective due to the malware's use of a rotating network of cloud domains for payload hosting, as identified by Fortinet researchers.

Silver Fox employs sophisticated evasion tactics within compromised networks. The group uses legitimate applications to sideload malicious dynamic link libraries (DLLs), facilitating a "Bring Your Own Vulnerable Driver" attack. This involves loading a Windows kernel-mode driver, wsftprm.sys, to gain elevated system privileges without detection.

Once established, the malware monitors and terminates active security processes, compromising antivirus and endpoint protection tools. This allows uninterrupted remote communication with command servers.

Organizations should exercise caution with unexpected documents and external links. It is recommended to implement behavioral monitoring tools, regularly update endpoint protection signatures, and deploy robust email filtering solutions to preemptively detect phishing attempts.

Based on reporting by Cyber Security News.