Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

SilverFox uses three driver BYOVD with ValleyRAT on Japan maker

Part of the Void Arachne story · since 28 Aug 2025

Quiet for 6 weekslast report 18 Sep27 articles10 outlets
28 Aug · Check Point first31 Mar12 Jun24 AugNowThis article20th of 27
  • Thu 28 Aug, 14:45 UTC. Check Point, first report. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows.
  • Fri 29 Aug, 08:00 UTC. GBHackers, its first report on the story. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems.
  • Mon 1 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor.
  • Tue 2 Sep, 10:15 UTC. The Hacker News, its first report on the story. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware.
  • Sat 18 Oct, 07:15 UTC. The Hacker News. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT.
  • Thu 4 Dec, 17:55 UTC. The Hacker News. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China.
  • Tue 9 Dec, 01:30 UTC. SecurityOnline. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT.
  • Fri 26 Dec, 01:20 UTC. SecurityOnline. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign.
  • Tue 30 Dec, 11:20 UTC. The Hacker News. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech.
  • Mon 23 Feb, 12:56 UTC. Malwarebytes, its first report on the story. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site.
  • Tue 24 Mar, 16:23 UTC. Infosecurity, its first report on the story. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage.
  • Tue 31 Mar, 12:55 UTC. The Hacker News. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains.
  • Thu 30 Apr, 07:06 UTC. Securelist, its first report on the story. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor.
  • Mon 4 May, 12:11 UTC. The Hacker News. Silver Fox Tax Phishing Hits Russia, India with ABCDoor.
  • Mon 4 May, 14:51 UTC. Dark Reading, its first report on the story. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT.
  • Mon 6 Jul, 14:11 UTC. SecurityOnline. ValleyRAT spreads via fake VLC installers targeting Asian users.
  • Fri 10 Jul, 13:46 UTC. The Hacker News. New MODBEACON RAT exploits gRPC stealth for encrypted attacks.
  • Sat 11 Jul, 02:30 UTC. SecurityOnline. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 11:10 UTC. The Hacker News. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker. This article, 20th of 27.
  • Fri 31 Jul, 08:00 UTC. Security Affairs, its first report on the story. SilverFox targets Japanese maker with ValleyRAT via DLL sideload.
  • Fri 21 Aug, 17:06 UTC. dti.domaintools.com, its first report on the story. Silver Fox malware network adapts, uses cloud to launch attacks.
  • Mon 31 Aug, 11:28 UTC. SecurityOnline. ValleyRAT backdoor hides in fake signed installers targeting Asia.
  • Mon 31 Aug, 12:41 UTC. The Hacker News. ValleyRAT backdoor hides in adware via antivirus exclusions.
  • Mon 31 Aug, 20:32 UTC. Security Affairs. ValleyRAT malware hides in fake wallpaper app to spy on users.
  • Mon 7 Sep, 08:31 UTC. SecurityOnline. Fake Software Sites Target Chinese Users with Stealthy Malware Installers.
  • Fri 18 Sep, 20:58 UTC. dti.domaintools.com. DomainTools Uncovers Russia’s Secret Cyber Training Programmes.

The article discusses a recent cyber threat involving a group named SilverFox targeting a Japanese manufacturer. It outlines the use of a sophisticated three-driver Bring Your Own Vulnerable Driver (BYOVD) attack combined with ValleyRAT malware to infiltrate networks. The piece emphasizes the growing risk posed by such tactics and highlights the need for increased cybersecurity measures. It also features resources on managing AI risks in code, identity fraud trends, and recommendations for improving security architectures.

How the story developed

All 27 articles
Quiet for 6 weekslast report 18 Sep27 articles10 outlets

27 articles from 10 outlets since 28 Aug. Quiet since 18 Sep. This was the 20th report, 336 days after the first.

Now28 Aug262115629252419134272419112First reportCheck Point · 28 Aug, 14:45This article20th of 27 · day 336Exploited CVESecurityOnline · 11 Jul
  • Thu 28 Aug, 14:45 UTC. Check Point, first report. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows.
  • Fri 29 Aug, 08:00 UTC. GBHackers, its first report on the story. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems.
  • Mon 1 Sep, 02:15 UTC. SecurityOnline, its first report on the story. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor.
  • Tue 2 Sep, 10:15 UTC. The Hacker News, its first report on the story. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware.
  • Sat 18 Oct, 07:15 UTC. The Hacker News. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT.
  • Thu 4 Dec, 17:55 UTC. The Hacker News. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China.
  • Tue 9 Dec, 01:30 UTC. SecurityOnline. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT.
  • Fri 26 Dec, 01:20 UTC. SecurityOnline. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign.
  • Tue 30 Dec, 11:20 UTC. The Hacker News. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware.
  • Fri 6 Feb, 01:41 UTC. SecurityOnline. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech.
  • Mon 23 Feb, 12:56 UTC. Malwarebytes, its first report on the story. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site.
  • Tue 24 Mar, 16:23 UTC. Infosecurity, its first report on the story. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage.
  • Tue 31 Mar, 12:55 UTC. The Hacker News. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains.
  • Thu 30 Apr, 07:06 UTC. Securelist, its first report on the story. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor.
  • Mon 4 May, 12:11 UTC. The Hacker News. Silver Fox Tax Phishing Hits Russia, India with ABCDoor.
  • Mon 4 May, 14:51 UTC. Dark Reading, its first report on the story. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT.
  • Mon 6 Jul, 14:11 UTC. SecurityOnline. ValleyRAT spreads via fake VLC installers targeting Asian users.
  • Fri 10 Jul, 13:46 UTC. The Hacker News. New MODBEACON RAT exploits gRPC stealth for encrypted attacks.
  • Sat 11 Jul, 02:30 UTC. SecurityOnline. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs. Cites a CVE in CISA KEV.
  • Thu 30 Jul, 11:10 UTC. The Hacker News. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker. This article, 20th of 27.
  • Fri 31 Jul, 08:00 UTC. Security Affairs, its first report on the story. SilverFox targets Japanese maker with ValleyRAT via DLL sideload.
  • Fri 21 Aug, 17:06 UTC. dti.domaintools.com, its first report on the story. Silver Fox malware network adapts, uses cloud to launch attacks.
  • Mon 31 Aug, 11:28 UTC. SecurityOnline. ValleyRAT backdoor hides in fake signed installers targeting Asia.
  • Mon 31 Aug, 12:41 UTC. The Hacker News. ValleyRAT backdoor hides in adware via antivirus exclusions.
  • Mon 31 Aug, 20:32 UTC. Security Affairs. ValleyRAT malware hides in fake wallpaper app to spy on users.
  • Mon 7 Sep, 08:31 UTC. SecurityOnline. Fake Software Sites Target Chinese Users with Stealthy Malware Installers.
  • Fri 18 Sep, 20:58 UTC. dti.domaintools.com. DomainTools Uncovers Russia’s Secret Cyber Training Programmes.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 27 articles as a list
  1. Thu 28 AugDay 01
    1. Chasing the Silver Fox: Cat & Mouse in Kernel Shadows14:45 · Check Point · First report
  2. Fri 29 AugDay 11
    1. Silver Fox Hackers Use Driver Vulnerability to Evade Security on Windows Systems08:00 · GBHackers

  3. Quiet for 3 days

    Mon 1 SepDay 41
    1. Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor02:15 · SecurityOnline · Picked up again
  4. Tue 2 SepDay 51
    1. Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware10:15 · The Hacker News

  5. Quiet for 7 weeks

    Sat 18 OctDay 511
    1. Silver Fox Expands Winos 4.0 Attacks to Japan and Malaysia via HoldingHands RAT07:15 · The Hacker News · Picked up again

  6. Quiet for 7 weeks

    Thu 4 DecDay 981
    1. Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China17:55 · The Hacker News · Picked up again

  7. Quiet for 4 days

    Tue 9 DecDay 1031
    1. Silver Fox APT Uses Cyrillic False Flag in Teams SEO Poisoning to Deploy ValleyRAT01:30 · SecurityOnline · Picked up again

  8. Quiet for 2 weeks

    Fri 26 DecDay 1201
    1. “Silver Fox” Unmasked: Chinese APT Group Impersonates Indian Tax Officials in Targeted Cyber Campaign01:20 · SecurityOnline · Picked up again

  9. Quiet for 4 days

    Tue 30 DecDay 1241
    1. Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware11:20 · The Hacker News · Picked up again

  10. Quiet for 5 weeks

    Fri 6 FebDay 1621
    1. Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech01:41 · SecurityOnline · Picked up again

  11. Quiet for 2 weeks

    Mon 23 FebDay 1791
    1. Silver Fox deploys ValleyRAT via typosquatted Huorong AV site12:56 · Malwarebytes · Picked up again

  12. Quiet for 4 weeks

    Tue 24 MarDay 2081
    1. Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage16:23 · Infosecurity · Picked up again

  13. Quiet for 7 days

    Tue 31 MarDay 2151
    1. Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains12:55 · The Hacker News · Picked up again

  14. Quiet for 4 weeks

    Thu 30 AprDay 2451
    1. Silver Fox tax phishing campaign spreads ValleyRAT and ABCDoor07:06 · Securelist · Picked up again

  15. Quiet for 4 days

    Mon 4 MayDay 2492
    1. Silver Fox Tax Phishing Hits Russia, India with ABCDoor12:11 · The Hacker News · Picked up again
    2. Silver Fox Uses Tax Scams to Deploy ABCDoor and ValleyRAT14:51 · Dark Reading

  16. Quiet for 9 weeks

    Mon 6 JulDay 3121
    1. ValleyRAT spreads via fake VLC installers targeting Asian users14:11 · SecurityOnline · Picked up again

  17. Quiet for 4 days

    Fri 10 JulDay 3161
    1. New MODBEACON RAT exploits gRPC stealth for encrypted attacks13:46 · The Hacker News · Picked up again
  18. Sat 11 JulDay 3171
    1. Silver Fox uses SEO tricks to drop MODBEACON trojan via bugs02:30 · SecurityOnline · Exploited CVE · Known exploited CVE

  19. Quiet for 3 weeks

    Thu 30 JulDay 3361
    1. SilverFox uses three driver BYOVD with ValleyRAT on Japan maker11:10 · The Hacker News · Picked up again · This article, 20th of 27
  20. Fri 31 JulDay 3371
    1. SilverFox targets Japanese maker with ValleyRAT via DLL sideload08:00 · Security Affairs

  21. Quiet for 3 weeks

    Fri 21 AugDay 3581
    1. Silver Fox malware network adapts, uses cloud to launch attacks17:06 · dti.domaintools.com · Picked up again

  22. Quiet for 10 days

    Mon 31 AugDay 3683
    1. ValleyRAT backdoor hides in fake signed installers targeting Asia11:28 · SecurityOnline · Picked up again
    2. ValleyRAT backdoor hides in adware via antivirus exclusions12:41 · The Hacker News
    3. ValleyRAT malware hides in fake wallpaper app to spy on users20:32 · Security Affairs

  23. Quiet for 6 days

    Mon 7 SepDay 3751
    1. Fake Software Sites Target Chinese Users with Stealthy Malware Installers08:31 · SecurityOnline · Picked up again

  24. Quiet for 12 days

    Fri 18 SepDay 3861
    1. DomainTools Uncovers Russia’s Secret Cyber Training Programmes20:58 · dti.domaintools.com · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in