Silver Fox APT Exploits Microsoft-Signed Driver to Deploy ValleyRAT Backdoor

On 1 September 2025, Check Point Research (CPR) revealed a sophisticated Silver Fox APT campaign that uses a previously unknown, Microsoft-signed vulnerable driver to disable endpoint protections and deploy the ValleyRAT backdoor across Windows systems.

The operation centres on a driver named amsdk.sys (WatchDog Antimalware, version 1.0.600), built on the Zemana Anti-Malware SDK, which CPR notes “this driver … was not classified as vulnerable, was signed by Microsoft, and not detected by Microsoft’s Vulnerable Driver Blocklist or community-driven sources like the LOLDrivers database.” This enabled load on fully updated Windows 10 and 11 machines and allowed attackers to terminate security processes and neutralise antivirus and EDR.

CPR explains that a dual-driver strategy was used for cross-version compatibility: a legacy Zemana driver for older systems and the undetected WatchDog driver for modern environments, all embedded in a self-contained loader with anti-analysis layers and the ValleyRAT downloader.

The attackers even modified the patched component wamsdk.sys (version 1.1.100) after disclosure, and “flipped a single byte in the unauthenticated timestamp field, preserving the driver’s valid Microsoft signature while generating a new file hash, effectively bypassing hash-based blocklists.” ValleyRAT then served as the final payload, a modular RAT enabling remote surveillance, command execution, and data exfiltration, reinforcing concerns about BYOVD-style attacks that weaponise signed-but-vulnerable drivers.