{"id":2595,"date":"2025-09-01T21:52:34","date_gmt":"2025-09-01T21:52:34","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2025\/09\/01\/silver-fox-exploits-signed-drivers-to-deploy-valleyrat-backdoor\/"},"modified":"2025-09-01T21:52:34","modified_gmt":"2025-09-01T21:52:34","slug":"silver-fox-exploits-signed-drivers-to-deploy-valleyrat-backdoor","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/09\/01\/silver-fox-exploits-signed-drivers-to-deploy-valleyrat-backdoor\/","title":{"rendered":"Silver Fox Exploits Signed Drivers to Deploy ValleyRAT Backdoor"},"content":{"rendered":"
\n

A newly detected cyber campaign is exploiting trusted but vulnerable Windows drivers to bypass security protections and install a remote access tool.<\/p>\n

The operation, attributed by Check Point Research (CPR) to the Silver Fox APT group, highlights the risks of attackers exploiting Microsoft-signed drivers that were once considered safe.<\/p>\n

Abusing Microsoft-Signed Drivers<\/h2>\n

At the center of the attack is the WatchDog Antimalware driver (amsdk.sys, version 1.0.600).<\/p>\n

Although signed by Microsoft and not previously listed as vulnerable, the driver was abused to terminate processes linked to antivirus and EDR tools, clearing the way for the deployment of ValleyRAT\u00a0\u2013\u00a0a modular backdoor capable of surveillance, command execution\u00a0and data exfiltration.<\/p>\n

Silver Fox also relied on an older Zemana-based driver (ZAM.exe<\/em>) to maintain compatibility across systems ranging from Windows 7 to Windows 11.<\/p>\n

Both drivers allowed arbitrary process termination, enabling the attackers to disable even protected processes.<\/p>\n

Read more on Windows driver exploitation tactics: Vulnerability in Windows Driver Leads to System Crashes<\/em><\/p>\n

Researchers found that the group packed all elements into self-contained loader binaries.<\/p>\n

Each sample included:<\/p>\n