hacker-news · Crawled Jul 30, 2026
SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
7 IoCs 2 Malware
Read original article ↗
AI Summary
The Chinese cybercrime group SilverFox targeted a Japanese industrial manufacturing organization using a sophisticated attack chain involving a three-driver BYOVD (Bring Your Own Vulnerable Driver) technique for kernel-level access and defense evasion. The attack began with a phishing email containing an invoice-themed lure, leading to DLL side-loading via malicious ZIP archives that deploy ValleyRAT, a Gh0st RAT variant. The malware uses multiple persistence and recovery mechanisms, including NTDLL unhooking, process injection, and a dual watchdog system to maintain remote access and resist removal.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 7 extracted
MITRE ATT&CK TTPs 40 techniques
T1006 Direct Volume Access · Defense Evasion T1012 Query Registry · Discovery T1014 Rootkit · Defense Evasion T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.003 Cron · Execution T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1112 Modify Registry · Defense Evasion T1134.001 Token Impersonation/Theft · Defense Evasion T1204.002 Malicious File · Execution T1484.002 Trust Modification · Defense Evasion T1548.002 Bypass User Account Control · Privilege Escalation T1566 Phishing · Initial Access T1005 Data from Local System · Collection T1021 Remote Services · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1055.012 Process Hollowing · Defense Evasion T1070.003 Clear Command History · Defense Evasion T1071 Application Layer Protocol · Command And Control T1085 T1085 T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1213 Data from Information Repositories · Collection T1213.001 Confluence · Collection T1543.001 Launch Agent · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1566.001 Spearphishing Attachment · Initial Access