{"id":10870,"date":"2026-02-23T10:04:02","date_gmt":"2026-02-23T10:04:02","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/23\/silver-fox-apt-uses-dll-sideloading-and-byovd-techniques-in-sophisticated-malware-attacks\/"},"modified":"2026-02-23T10:04:02","modified_gmt":"2026-02-23T10:04:02","slug":"silver-fox-apt-uses-dll-sideloading-and-byovd-techniques-in-sophisticated-malware-attacks","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/23\/silver-fox-apt-uses-dll-sideloading-and-byovd-techniques-in-sophisticated-malware-attacks\/","title":{"rendered":"Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks"},"content":{"rendered":"

Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

The cybersecurity community recently witnessed the emergence of targeted malware campaigns linked to the Silver Fox threat group. <\/p>\n

This operation focuses heavily on Asia, targeting local organizations with carefully localized lures. <\/p>\n

By disguising attacks as routine business communications, actors successfully distributed the Winos 4.0 malware, known as ValleyRat, into corporate networks.<\/p>\n

To compromise victim systems, attackers leverage deceptive phishing emails<\/a> containing malicious attachments or embedded links. <\/p>\n

These messages closely impersonate official government correspondence, such as tax audit notifications, software installers, and electronic invoice downloads.<\/p>\n

\n
\"\"
Tax-themed phishing (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

When a user interacts with these files, they trigger a complex infection chain that operates quietly, minimizing the chances of immediate user suspicion.<\/p>\n

The final impact of a successful infection is severe, leading to widespread file encryption and extensive data theft<\/a> that can fuel further cyberattacks. <\/p>\n

\n
\"Attacker\u2019s
Attacker\u2019s domain (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

Fortinet researchers identified the malware<\/a> and its infrastructure as highly volatile, utilizing a rotating network of cloud domains to host their payloads. <\/p>\n

This rapid shifting of resources makes traditional static domain blocking mostly ineffective as a primary defense measure against the ongoing Winos 4.0 operations.<\/p>\n

Advanced Detection Evasion Techniques<\/strong><\/h2>\n

Once inside a network, the Silver Fox group employs advanced detection evasion strategies to maintain access and control. <\/p>\n

The attackers deliver an archive containing a legitimate application that secretly sideloads a malicious dynamic link library into memory.<\/p>\n

\n
\"The
The execution file and the malicious DLL file (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

This stage sets the foundation for a \u201cBring Your Own Vulnerable Driver\u201d attack. The malware loads a validity-signed Windows kernel-mode driver, named wsftprm.sys, to silently acquire elevated system privileges<\/a> without alerting administrators.<\/p>\n

\n
\"Archive
Archive contents with LNK and social-engineering decoys (Source \u2013 Fortinet)<\/figcaption><\/figure>\n<\/div>\n

After securing kernel-level access, the malicious driver enters a continuous monitoring loop to identify and terminate active security processes. <\/p>\n

By targeting a vast array of popular antivirus and endpoint protection tools<\/a>, the malware creates a completely blind environment. This allows Winos 4.0 to operate, escalate its privileges, and maintain remote communication with its command server unimpeded.<\/p>\n

To effectively defend against these highly sophisticated techniques, organizations must treat all unexpected documents and external links with extreme caution. <\/p>\n

Security teams should implement behavioral monitoring tools, continuously update endpoint protection signatures, and deploy strong email filtering solutions to proactively detect evasive phishing attempts before they occur.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Silver Fox APT Uses DLL Sideloading and BYOVD Techniques in Sophisticated Malware Attacks The cybersecurity community recently witnessed the emergence of targeted malware campaigns linked to the Silver Fox threat group. This operation focuses heavily on Asia, targeting local organizations with carefully localized lures. By disguising attacks as routine business communications, actors successfully distributed the […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-10870","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10870"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10870"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10870\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10870"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10870"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10870"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}