CyberHappenings logo
☰
🏠 Home 📂 Browse ℹī¸ About

Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Silver Fox, a threat actor, has been exploiting a vulnerable driver associated with WatchDog Anti-malware in a Bring Your Own Vulnerable Driver (BYOVD) attack to disable security solutions on compromised hosts. The driver, amsdk.sys (version 1.0.600), is a Microsoft-signed Windows kernel device driver built upon Zemana Anti-Malware SDK. The campaign, first observed in late May 2025, aims to deploy ValleyRAT (aka Winos 4.0) for remote access and control. The threat actor uses a dual-driver strategy, targeting Windows 7 with a known vulnerable Zemana driver and Windows 10/11 with the undetected WatchDog driver. The attacks employ an all-in-one loader with anti-analysis features and antivirus killer logic. The WatchDog driver has multiple vulnerabilities, including the ability to terminate arbitrary processes and local privilege escalation. The campaign has adapted to a patch released by WatchDog, bypassing signature-based defenses by altering a single byte in the driver. Silver Fox targets Chinese-speaking victims using fake websites and trojanized software, primarily distributing ValleyRAT. The group is highly active and organized, with multiple sub-clusters targeting different sectors, including finance and manufacturing.

Timeline

  1. 02.09.2025 11:39 📰 1 articles

    Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware

    Silver Fox has been exploiting a vulnerable driver associated with WatchDog Anti-malware in a BYOVD attack to disable security solutions on compromised hosts. The driver, amsdk.sys (version 1.0.600), is a Microsoft-signed Windows kernel device driver built upon Zemana Anti-Malware SDK. The campaign, first observed in late May 2025, aims to deploy ValleyRAT for remote access and control. The threat actor uses a dual-driver strategy, targeting Windows 7 with a known vulnerable Zemana driver and Windows 10/11 with the undetected WatchDog driver. The attacks employ an all-in-one loader with anti-analysis features and antivirus killer logic. The WatchDog driver has multiple vulnerabilities, including the ability to terminate arbitrary processes and local privilege escalation. The campaign has adapted to a patch released by WatchDog, bypassing signature-based defenses by altering a single byte in the driver. Silver Fox targets Chinese-speaking victims using fake websites and trojanized software, primarily distributing ValleyRAT. The group is highly active and organized, with multiple sub-clusters targeting different sectors, including finance and manufacturing.

    Show sources
    Open in new tab

Information Snippets