Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems

According to Check Point Research, on 28 August 2025 the Silver Fox APT group was observed exploiting a previously unknown vulnerable driver to bypass endpoint detection and response and antivirus on fully updated Windows 10 and 11 systems. They used the WatchDog Antimalware driver (amsdk.sys version 1.0.600), a Microsoft-signed component, to terminate protected processes and evade contemporary security solutions, deploying a dual-driver approach to cover different Windows versions.

Legacy systems such as Windows 7 saw use of the Zemana driver that is already blocked by security measures, while modern Windows 10 and 11 environments received the undetected WatchDog driver, which maintained a valid Microsoft signature. The campaign centres around an all-in-one loader that combines multiple components, including two embedded vulnerable drivers and the ValleyRAT downloader module, with Termaintor and Amsdk_Service establishing persistence and driver loading across versions.

Researchers note exclusions for certain computer names during execution and describe the attackers’ use of IOCTL commands to terminate security processes, effectively disabling endpoint protection. The response includes a patched driver, but checks remain incomplete, prompting continued exploitation and the delivery of ValleyRAT, a Remote Access Trojan, via the loader.