Originally published on satyamrastogi.com

SilverFox APT exploits 3-driver BYOVD chain to bypass kernel security, delivering ValleyRAT for persistent access in Japanese manufacturing sector. Kernel exploitation meets supply chain targeting.

---

SilverFox BYOVD Chain: 3-Driver Kernel Exploit Against Japanese Manufacturers

Executive Summary

SilverFox, a Chinese cybercrime collective with established APT infrastructure, has weaponized a three-driver bring-your-own-vulnerable-driver (BYOVD) exploit chain targeting Japanese industrial manufacturers. The campaign chains legitimate but flawed kernel drivers to achieve arbitrary code execution at the highest privilege level, ultimately deploying ValleyRAT (Winos 4.0 variant) for persistent remote access. This represents a mature BYOVD methodology that bypasses modern kernel security controls, particularly relevant for organizations relying on legacy industrial software ecosystems.

The attack surface here is critical: BYOVD eliminates the need for zero-days while leveraging known-but-unpatched vulnerabilities in signed drivers that pass Windows Code Integrity checks. Japanese manufacturing environments, typically hardened but slow to patch legacy dependencies, present optimal targets.

Attack Vector Analysis

BYOVD as a Privilege Escalation Engine

BYOVD attacks fall under MITRE ATT&CK T1197 - BYOVD (Abuse Elevation Control Mechanism). SilverFox's methodology chains multiple vulnerable drivers rather than relying on a single exploit-one approach, creating redundancy and evasion depth.

The three-driver chain likely follows this progression:

1. Initial Access Driver: Loads unsigned code or modifies kernel memory allocation pools
2. Escalation Driver: Leverages the first driver's primitives to gain Read-Write-Execute (RWX) access to kernel address space
3. Persistence Driver: Establishes hooks or callbacks that survive reboot, enabling stealthy payload execution

This layering is deliberate-if one driver gets quarantined or patched, the chain fails, but interim reports suggest SilverFox maintains multiple chain variants in their arsenal.

ValleyRAT as the Final Payload

ValleyRAT (identified as Winos 4.0 variant) is a remote access trojan with capabilities aligned with MITRE ATT&CK T1005 - Data from Local System and T1041 - Exfiltration Over C2 Channel. The malware maintains persistence through kernel-mode callbacks, making detection via user-mode monitoring insufficient.

The choice of manufacturing-focused targeting suggests data exfiltration of CAD designs, process parameters, or supply chain documentation rather than ransomware deployment-a pattern consistent with Chinese state-affiliated IP theft operations.

Technical Deep Dive

Driver Vulnerability Classes

Common BYOVD drivers in the Japanese manufacturing supply chain typically exhibit:

• Unvalidated IOCTL Parameters: Kernel drivers processing user-mode input without bounds checking
• Pool Overflow Exploitation: Non-Paged Pool overflow chains enabling arbitrary memory read/write
• Arbitrary Physical Memory Access: Drivers providing direct access to physical memory (common in hardware monitoring tools)

Example pseudocode showing typical IOCTL vulnerability:

// Vulnerable IOCTL handler (simplified)
IOCTL_HANDLER(pDeviceObject, pIrp) {
 PVOID pInputBuffer = pIrp->AssociatedIrp.SystemBuffer;
 ULONG inputSize = pIrp->IoStackLocation->Parameters.DeviceIoControl.InputBufferLength;

 // No validation of pInputBuffer or inputSize
 WRITE_KERNEL_MEMORY(*(PVOID*)pInputBuffer); // VULNERABLE

 return STATUS_SUCCESS;
}

SilverFox's chain likely exploits 3-4 such IOCTL handlers sequentially, each unlocking deeper kernel access:

Stage 1: Leak kernel base via arbitrary read
Stage 2: Locate kernel function pointers, corrupt them to redirect execution
Stage 3: Execute shellcode in kernel context, load persistence module

Persistence Mechanism

ValleyRAT execution via kernel-mode driver callbacks suggests:

• Hooking kernel notification routines (e.g., CmRegisterCallback for registry operations)
• Intercepting filesystem operations via FsRtlRegisterUncProvider
• Establishing Windows Callback Objects that execute ValleyRAT on system events

This kernel-mode persistence survives user-mode EDR monitoring and standard antivirus scans, as callbacks execute within the kernel trusted execution environment.

Detection Strategies

Kernel-Mode Monitoring

1. Driver Load Auditing: Monitor PnpTriggerDeviceEnumeration and IoCreateDevice calls for unsigned or rarely-loaded drivers

 Event: Image Load, CommandLine: *driver*.sys, Signed: False, ImageLoadFlags: contains DONT_LOAD_ENTRY_IMAGE

1. IOCTL Traffic Analysis: Correlate unusual IOCTL codes across driver instances within short timeframes

 Sysmon Event 7: Image Load
 TargetImage: C:\Windows\System32\drivers\*.sys
 Signed: False OR Publisher: Test Certificate

1. Memory Anomaly Detection: Kernel-mode memory writes outside normal driver operation patterns
   • Non-Paged Pool allocations followed by immediate kernel code modifications
   • Cross-process memory writes initiated from kernel callbacks

Behavioral Signatures

• Legitimate manufacturing software (e.g., industrial CAD tools, machinery control interfaces) followed by unexpected driver installation
• Spikes in IOCTL processing without corresponding user-mode API calls
• Scheduled tasks or WMI event subscriptions creating elevated processes at irregular intervals

The manufacturing sector's reliance on OPC-UA and PROFINET protocols means traditional network detection may miss kernel-mode C2 channels that tunnel through legitimate industrial protocols.

Mitigation & Hardening

Immediate Actions

1. Vulnerable Driver Blocklist: Implement Microsoft's Vulnerable Driver Blocklist in Group Policy

 Computer Configuration > Administrative Templates > System > Driver Installation > Unsigned Driver Installation
 Set to: Block (Silently)

1. HVCI Enforcement: Enable Hypervisor-Protected Code Integrity on critical manufacturing systems

   • Prevents unsigned drivers from loading by enforcing kernel-mode code signing
   • May conflict with legacy industrial software, necessitating compatibility testing

2. Audit Privileged Drivers: Inventory all drivers on manufacturing systems, prioritize removal of unsigned/unmaintained ones

Architectural Mitigations

• Kernel-Mode Threat Detection: Deploy real-time kernel monitoring via Windows Defender for Endpoint or similar EDR platforms with kernel-mode visibility
• Network Segmentation: Isolate manufacturing OT networks from corporate IT using CISA OT segmentation guidance to prevent lateral movement post-compromise
• Supply Chain Verification: Audit industrial software dependencies for BYOVD-vulnerable components, enforce vendor patching cycles

Detection-Focused Mitigation

Implement MITRE ATT&CK D3009 - Driver Isolation practices:

• Disable loading of unsigned drivers system-wide where feasible
• Monitor and restrict IOCTL calls to known-vulnerable drivers (reference: NVD Database for publicly disclosed BYOVD vulnerabilities)
• Implement kernel-mode callback filtering to detect unauthorized process creation or registry modification hooks

Key Takeaways

• BYOVD Chains are Operationalized: SilverFox's three-driver methodology indicates mature weaponization; BYOVD is no longer theoretical research but active APT tradecraft
• Japanese Manufacturing is High-Value: Industrial targeting combined with persistent RAT deployment suggests IP theft over destructive operations; expect data exfiltration campaigns
• Kernel-Mode Persistence Bypasses User-Space Defenses: Standard EDR and antivirus solutions lack kernel-mode visibility; HVCI and driver signing enforcement are essential
• Supply Chain Vulnerability: Legacy industrial software dependencies create durable attack surfaces; patch management cycles in OT environments enable long-term exploitation windows
• Defense Requires Kernel-Level Visibility: Organizations must move beyond user-mode monitoring to detect BYOVD chains; consider kernel-mode EDR or Windows Defender for Endpoint with attestation policies

Related Articles

For deeper context on privilege escalation and kernel exploitation:

• OT Isolation as Attack Surface: Weaponizing CISA's Defense Guidance - Industrial segmentation fails when kernel-mode backdoors bypass network controls
• RufRoot: Patch-Resistant Memory Corruption in AI Hosting Platforms - Similar kernel exploitation patterns in cloud infrastructure
• SonicWall SMA1000 Zero-Days: VPN Appliance RCE & Malware Deployment - Complementary initial access vector for Japanese enterprises