A threat group tracked as SilverFox has refined its malware delivery playbook in a campaign aimed at a Japanese industrial manufacturer, layering together several evasion tricks that researchers say make the intrusion unusually hard to fully remove once it takes hold.

The operation, documented by analysts at CATO Networks, begins with a familiar lure: a fake invoice email that convinces a recipient to download a ZIP archive from what looks like a legitimate file-hosting service. From there, the attack takes a more unusual turn.

Hiding Inside Trusted Software

Rather than launching an obviously malicious executable, SilverFox packages its loader alongside a legitimate, digitally signed PDF utility. When the trusted application starts, Windows picks up the attacker’s malicious library from the same folder instead of the genuine one — a technique known as DLL sideloading. The signed software itself is never modified, and its maker appears to have no knowledge of the abuse.

In some observed samples, the attackers went a step further and renamed a legitimate application so it resembled a Microsoft update component, adding another layer of camouflage for anyone glancing at a process list or file name.

Vulnerable Drivers Used to Disable Security Tools

Once running, the malicious loader decrypts and installs one of several signed but exploitable kernel drivers on the victim machine. Because these drivers operate at the deepest level of Windows, they let SilverFox terminate antivirus and endpoint detection processes in ways that ordinary user-level malware cannot manage. CATO Networks notes that this campaign introduces two driver families not previously linked publicly to the group, giving the operators backup options if one driver is blocked or flagged.

This is not a new tactic for SilverFox, which has a documented history of abusing vulnerable drivers to blind security software. What has changed is the redundancy built into the newest version of the toolkit.

A Resilient Path to ValleyRAT

With security visibility reduced, the malware reaches out to its command-and-control server and injects shellcode into a suspended Windows service process, redirecting its execution path so the malicious code runs the moment the process resumes. It also restores a clean, in-memory copy of a core Windows library in an apparent effort to strip out user-level monitoring hooks — though this step does not touch kernel-level logging or network-based detection.

Persistence is where the campaign becomes especially difficult to clean up. SilverFox creates a scheduled task that relaunches its loader every time a user logs in, and a watchdog script checks roughly every 30 seconds that the loader is still active, restarting it if it has been killed. A second monitoring process can even rebuild the injected payload if that piece is stopped independently. The end result, according to researchers, is ValleyRAT, a full-featured remote access trojan that hands the attackers ongoing control of the infected machine.

What Defenders Should Watch For

Because the campaign relies on chaining several techniques together rather than one static signature, CATO Networks recommends that defenders focus on behavioral sequences instead of individual indicators. Useful warning signs include:

• DLL loading from temporary directories tied to otherwise legitimate applications
• Unexpected installation of vulnerable driver services
• A suspended Windows process followed by unusual memory modification
• Unfamiliar Registry writes under keys used to stash configuration data
• Recurring watchdog-style scheduled tasks or scripts checking process status every few seconds

Security teams that suspect an infection are advised to isolate the affected system immediately, trace the full process tree rather than killing a single process, remove any malicious scheduled tasks and driver services, and rotate credentials that may have been exposed while the remote access tool was active. Because the malware’s recovery mechanisms are designed to rebuild the chain if only one stage is removed, incomplete remediation can allow the infection to silently return.

The campaign is a reminder that signed software and valid digital certificates are no longer a reliable trust signal on their own. Organizations that rely heavily on allowlisting trusted vendors should pair that approach with behavioral monitoring capable of catching sideloading and driver abuse regardless of which legitimate application is being exploited as cover.