Chasing the Silver Fox: Cat & Mouse in Kernel Shadows

Chasing the Silver Fox: Cat & Mouse in Kernel Shadows, published on 28 August 2025, details an in-the-wild campaign attributed to the Silver Fox APT that abuses a previously unknown vulnerable driver, amsdk.sys, built on the Zemana Anti-Malware SDK.

According to Check Point Research, the loader uses two embedded drivers—the older Zemana-based ZAM.exe for Windows 7 and a newer WatchDog Antimalware driver, amsdk.sys, for Windows 10/11—that are Microsoft-signed and not listed on the Microsoft Vulnerable Driver Blocklist or LOLDrivers. The attackers terminate protected processes to bypass EDR/AV protections and deliver ValleyRAT, also known as Winos, with infrastructure located in China.

After CPR disclosed the findings, a patched WatchDog driver, wamsdk.sys version 1.1.100, was released, though attackers subsequently modified a single unauthenticated timestamp byte to create a new, still-valid signed variant that evades hash-based blocks. ValleyRAT is delivered via an all-in-one loader that combines anti-analysis features, embedded drivers, and a ValleyRAT downloader, with C2 servers in China.

The report emphasises the need for behaviour-based detection and layered protections beyond hash or signature checks to mitigate Bring Your Own Vulnerable Driver techniques.