Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware

The threat actor known as Silver Fox has been attributed to abusing a previously unknown vulnerable driver linked to WatchDog Anti-malware as part of a Bring Your Own Vulnerable Driver attack aimed at disarming security tools on compromised hosts.

The vulnerable driver, amsdk.sys (version 1.0.600), is a 64-bit, Microsoft-signed Windows kernel driver built on the Zemana Anti-Malware SDK, and was described by Check Point as not listed in Microsoft’s Vulnerable Driver Blocklist or detected by community projects like LOLDrivers.

The campaign employs a dual-driver approach, using a known vulnerable Zemana driver for Windows 7 and the undetected WatchDog driver for Windows 10 and 11, with WatchDog’s driver reportedly able to terminate arbitrary processes and perform local privilege escalation.

The end goal is to neutralise endpoint protection to enable malware deployment and persistence, with ValleyRAT (also known as Winos 4.0) delivered as the final payload via an all-in-one loader that includes anti-analysis, two embedded drivers, antivirus killer logic, and a ValleyRAT DLL downloader, according to Check Point.

Following responsible disclosure, Watchdog released patch version 1.1.100 to strengthen DACLs, but attackers reportedly adapted by altering a single byte to preserve the Microsoft signature and bypass hash-based blocklists, according to Check Point.