As reported by The Hacker News, the Chinese cybercrime group SilverFox has been observed executing a multi-stage bring-your-own-vulnerable-driver (BYOVD) attack chain against a Japanese industrial manufacturing organization, culminating in the deployment of ValleyRAT (also tracked as Winos 4.0) for persistent remote access. This campaign represents a meaningful evolution in SilverFox's operational tradecraft — and a serious warning signal for the broader industrial sector.
Why BYOVD at This Sophistication Level Matters
BYOVD is not a new technique. Threat actors have been abusing legitimately signed, vulnerable kernel drivers for years to disable endpoint defenses and escalate privileges. What makes this SilverFox campaign noteworthy is the deliberate chaining of three vulnerable drivers — a level of redundancy and layering that suggests significant pre-operational planning and a deep understanding of endpoint detection and response (EDR) bypass methodologies.
When a single BYOVD attempt fails — perhaps because the vulnerable driver is blocked by a WDAC (Windows Defender Application Control) policy or flagged by a security tool — a single-driver approach collapses. A three-driver chain provides fallback options and dramatically increases the likelihood that at least one driver successfully terminates or blinds the defensive tooling before the final payload is deployed. This is adversarial engineering, not opportunistic exploitation.
Shield53 Assessment: The use of a 3-driver BYOVD chain is a strong indicator that SilverFox operators are actively testing and hardening their attack tooling against modern enterprise defenses. Organizations should not assume their EDR will stop this class of attack without additional layered controls.
ValleyRAT: A Capable and Persistent Threat
ValleyRAT (Winos 4.0) is a modular remote access trojan with a track record in Chinese-nexus campaigns. It is not commodity malware — it supports plugin-based extensibility, allowing operators to load capabilities post-compromise on demand. This means initial detection of ValleyRAT on a network may represent only a fraction of the attacker's actual footprint and capability set. Security teams investigating a ValleyRAT infection should treat it as a full intrusion, not a simple malware removal exercise.
Why Japanese Industrial Manufacturing Is Being Targeted
Japan's manufacturing sector is a crown jewel of industrial intellectual property — precision engineering, automotive supply chains, robotics, and semiconductor-adjacent production all intersect here. For a Chinese cybercrime group (which may blur lines with state-aligned collection priorities), targeting Japanese industrial manufacturers offers dual value: financial gain through potential extortion or data monetization, and access to proprietary manufacturing processes and supplier relationships.
IT/OT convergence in modern manufacturing plants also creates an attractive attack surface. A persistent foothold via ValleyRAT in the IT environment carries the risk of lateral movement toward operational technology networks, SCADA systems, and industrial control infrastructure — a scenario with consequences far beyond data theft.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Audit loaded drivers. Enumerate all kernel drivers present in your environment and cross-reference against the LOLDRIVERSPROJECT blocklist and Microsoft's vulnerable driver blocklist. Remove or block any drivers not required for operations.
- Deploy or audit WDAC policies. Windows Defender Application Control with a strict driver allow-list is currently the most effective mitigation against BYOVD attacks. If WDAC is in place, verify it covers kernel-mode drivers specifically.
- Enable Microsoft's Vulnerable Driver Blocklist. This is now available via HVCI (Hypervisor-Protected Code Integrity) and Windows Security settings — ensure it is enforced, not just configured.
- Hunt for ValleyRAT indicators. Engage your threat intelligence feeds for current ValleyRAT/Winos 4.0 IOCs and run retrospective hunts across endpoint telemetry, DNS logs, and proxy logs for the past 90 days.
Strategic Controls
- Implement network segmentation between IT and OT environments. A ValleyRAT infection should never have a network path to industrial control systems. Verify your segmentation controls with active testing.
- Adopt a assume-breach posture for EDR. If your entire defensive strategy rests on EDR catching malware pre-execution, BYOVD chains will defeat you. Pair behavioral detection with canary tokens, deception assets, and anomalous process monitoring.
- Monitor for suspicious driver loads at runtime. SIEM rules should alert on unsigned or newly appearing kernel drivers — particularly those loaded from user-writable directories or temporary paths.
- Brief your SOC on SilverFox TTPs. Ensure your analyst team is familiar with this group's known tradecraft so triage decisions appropriately escalate SilverFox-pattern alerts rather than treating them as routine malware infections.
SilverFox's continued investment in sophisticated evasion infrastructure is a reminder that financially motivated cybercrime groups are increasingly indistinguishable from nation-state APTs in their technical capabilities. Defenders in the industrial sector cannot afford to benchmark their defenses against yesterday's threat models.
