Executive Summary
In early 2026, the threat actor suspected to be Silver Fox launched spear-phishing campaigns against Japanese organizations, using human resources-themed decoys. The attacks initially delivered PXDropper, which deploys the 'PoisonX' kernel driver and the '10FXRAT' (also known as PoisonX RAT). This modular malware infrastructure enables extensive remote control, information theft, and lateral movement capabilities.
A significant technical feature of this campaign is the use of Bring Your Own Vulnerable Driver (BYOVD) techniques. Attackers used the PoisonX driver to terminate security processes from the kernel level and hide malicious network traffic. Later iterations in May 2026 evolved to use legitimately signed but vulnerable drivers like 'EneIo64.sys' and 'procexp.sys' to achieve similar EDR/AV evasion, highlighting the actor's rapid adaptation to bypass modern defenses.
The impact is severe as the malware specifically targets credential theft from cryptocurrency wallets, messaging apps like Telegram and Signal, and business platforms like WeChat and Lark. The ability to disable over 40 security products, including Microsoft Defender and CrowdStrike, makes this threat highly effective at maintaining long-term persistence within targeted networks.