SilverFox Campaign Turns ValleyRAT Into Multi-Stage Malware With Rootkit Capabilities

The SilverFox advanced persistent threat (APT) group has escalated its offensive toolkit by transforming ValleyRAT from a conventional remote access trojan into an eight-stage malware chain culminating in a kernel-mode rootkit.

This evolution marks a significant shift in post-exploitation persistence, blending user-mode orchestration with deep kernel control to evade detection and maintain long-term access.

The attack begins with DLL sideloading, where trojanized installers abuse legitimate signed executables to execute malicious payloads under the guise of trusted software.

Early stages employ ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) bypasses, alongside PNG steganography that hides shellcode within pixel channels of image files.

This technique allows the malware to bypass signature-based detection by embedding payloads in seemingly benign assets.

Privilege escalation follows, enabling deeper system access and facilitating the delivery of additional steganographic payloads.

The chain then deploys nested Donut shellcode, a reflective loader that executes payloads entirely in memory, avoiding disk-based forensic artifacts.

At the core of the campaign is the ValleyRAT orchestrator, a modular RAT that coordinates subsequent stages and maintains command-and-control (C2) communications over WebSocket and QUIC protocols.

QUIC’s encryption and UDP-based transport make traffic analysis and interception significantly harder for network defenders.

The RAT also checks for virtualized environments, specifically VMware, to avoid analysis in sandboxed setups.

The final stage introduces a kernel-mode rootkit with over 65 IOCTL (Input/Output Control) handlers, granting the attackers direct control over low-level system operations.

This rootkit communicates with ValleyRAT via named pipes, a stealthy inter-process communication method that avoids traditional network-based detection.

According to Gen Threat Labs, ValleyRAT’s modular design allows it to load auxiliary plugins dynamically, including those performing geofencing checks before retrieving additional backdoors like ABCDoor.

The rootkit’s capabilities include process manipulation, driver loading, and memory interception, effectively placing the attackers in control of the operating system’s kernel.

Additionally, an AV killer module is injected into svchost.exe to terminate security services and disable protective mechanisms.

SilverFox Expands ValleyRAT Attack

Beyond persistence, the campaign incorporates data exfiltration features such as crypto clipboard hijacking to steal cryptocurrency wallet addresses and Telegram credential theft to compromise messaging accounts.

Plugin delivery over named pipes enables modular expansion of functionality without additional network traffic, further reducing detection likelihood.

The group recompiles up to 13 polymorphic samples per victim over a 12-day window, rotating file paths daily under C:\Drivers to avoid heuristic detection.

SilverFox, a Chinese-affiliated APT, has been observed targeting organizations in India, Russia, and across the APAC region using tax-themed lures, fake software installers, and trojanized language packs.

The group’s use of living-off-the-land binaries, custom loaders, and multi-stage infection chains underscores a high level of operational maturity.blog.

Defenders should monitor for MSI installations with VBScript custom actions launching PowerShell, suspicious process names like GjdLUhqZIJJB.exe, and kernel driver loads matching known PDB signatures.

Network teams should inspect WebSocket and QUIC traffic anomalies, while endpoint solutions must enforce kernel driver signing and monitor named pipe usage for unauthorized IPC.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.