The SilverFox cyber group has expanded its arsenal, targeting a Japanese industrial firm with sophisticated malware techniques. This campaign involves the use of trusted software to deploy malicious components, bypassing security measures without altering the signed applications, a method known as DLL sideloading.
Phishing Campaign and Malware Deployment
SilverFox initiated its attack with a deceptive email containing a fake invoice, encouraging the recipient to download a ZIP file from a seemingly legitimate source. This file contained a malicious payload that exploited a trusted software application to execute harmful code, a method reminiscent of the techniques used in the AsyncRAT DLL sideloading incidents.
CATO Networks identified the SilverFox operation, linking it to the group with moderate-to-high confidence. Their report, shared with Cyber Security News, highlights the deployment of ValleyRAT, a remote-access tool granting control over compromised systems. This operation’s significance lies in its combination of various detection evasion techniques.
Exploiting Trusted Software for Malware Execution
The attackers strategically paired legitimate PDF-related applications with malicious libraries within the same directory. When the genuine application is launched, the malicious library is executed first, exploiting the application’s digital signature to avoid detection. This tactic mirrors recent trends where legitimate software is abused to conceal malicious activities.
SilverFox further enhanced its approach by adding previously unassociated driver families to their toolkit. These drivers are capable of terminating protected antivirus processes at the kernel level, allowing the malware to bypass ordinary security controls effectively.
Ensuring Persistence and Avoiding Detection
Once SilverFox reduces the system’s security visibility, it contacts its command server to download and execute additional malicious code. Instead of starting a new process, it injects the code into a suspended Windows service, altering its execution path to launch the malware stealthily.
The campaign includes mechanisms to maintain persistence, such as scheduled tasks and watchdog scripts that ensure the malicious loader remains active. Security teams are advised to monitor for suspicious DLL loadings, vulnerable driver service creations, and unusual Registry activity to detect and neutralize these threats.
Security professionals should act swiftly to isolate and investigate affected systems, remove malicious scheduled tasks, and update exposed credentials. A comprehensive response is crucial, as blocking a single component may not dismantle the entire infection chain.
