SilverFox ValleyRAT Campaign Targeting Japanese Manufacturers

The Chinese cybercrime group Silver Fox (also known as TA4922 or FaCai) has evolved its tradecraft to target the Japanese industrial manufacturing sector. The campaign utilizes a sophisticated attack chain starting with invoice-themed phishing lures leading to the deployment of ValleyRAT (Winos 4.0). The actor leverages legitimate cloud services like QQ and Tencent Cloud for staging and redirects, followed by DLL sideloading via trusted applications such as ConvertToPDF.exe.

Technically, the campaign is notable for its modular Bring Your Own Vulnerable Driver (BYOVD) framework, which now includes BootRepair.sys and EnPortv.sys alongside wsftprm.sys. These drivers are used to terminate security processes from kernel mode, effectively blinding EDR and AV solutions. The malware also implements advanced evasion like NTDLL unhooking and thread-context hijacking to inject shellcode into svchost.exe processes, while maintaining resilience through a dual-watchdog design that monitors both the loader and the payload.

This activity represents a high threat to industrial targets due to the group's ability to bypass modern endpoint security controls and maintain long-term persistent access through registry-resident payloads and multi-layered recovery mechanisms.