SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD — Threadlinqs Intelligence
As of 2026-08-06, SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD is a high-severity malware threat attributed to Void Arachne (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 34 indicators of compromise.
Threat ID: TL-2026-1787 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-08-06 · revalidated 1× · latest source
Attribution: Void Arachne · China · ESPIONAGE
SilverFox (aka Void Arachne / SwimSnake) is targeting a Japanese industrial manufacturer with invoice-themed phishing delivered via abused QQ and Tencent Cloud infrastructure, DLL side-loading through
Cato Networks CTRL documented an evolved SilverFox intrusion chain against a Japanese industrial manufacturing organization beginning with an invoice-themed phishing email whose attacker-controlled content is hosted on legitimate QQ (file.wx2.qq.com) and Tencent Cloud COS (hrefbfdhfhgre-1422102728.cos.ap-hongkong.myqcloud.com) infrastructure, evading reputation-based network defenses. The email leads to a timestamped ZIP archive (e.g. 20260608154418.zip) that triggers DLL side-loading: the legitimate, digitally signed Zeon Corporation Right PDF utilities ConvertToPDF.exe and PDFDirect.exe resolve a malicious PDFCORE8.dll from their local working directory (previously undocumented abuse of these binaries for side-loading), sometimes staged under the decoy filename MicrosoftEdgeUpdate.exe.
PDFCORE8.dll embeds three RC4-encrypted (hardcoded 128-bit key BB7BBB62FD9C76D5DDF37F17DDC3E7FF) vulnerable kernel drivers as PE resources: wsftprm.sys (Topaz OFD's Topaz Warsaw antifraud driver, CVE-2023-52271, previously associated with SilverFox), and two previously undocumented SilverFox drivers, BootRepair.sys (a legitimate Lenovo PC Manager driver signed 2018-01-03) and EnPortv.sys. Each driver is decrypted, dropped, loaded as a kernel service via the standard Service Control Manager workflow, and then abused through an IOCTL that reaches ZwTerminateProcess() in kernel context with no caller validation — killing Protected-Process-Light-protected EDR/AV agents that user-mode code cannot touch. The framework is modular, reusing the same loader logic while swapping driver image, device object name (\\.\EnPortv, \\.\Warsaw_PM, \\.\BootRepair), and IOCTL code (0x223078, 0x22201C, 0x222014 respectively) per embedded driver.
After clearing security tooling, the loader performs NTDLL unhooking by loading a clean copy of ntdll.dll from disk and overwriting the in-memory .text section to strip user-mode inline hooks, then injects into a suspended svchost.exe via classic thread-context hijacking (CreateProcessA + CREATE_SUSPENDED, VirtualAllocEx, WriteProcessMemory, GetThreadContext/SetThreadContext, ResumeThread). API and library names are resolved dynamically via runtime-constructed strings and LoadLibraryW/GetProcAddress to frustrate static detection. Final-stage shellcode and C2 configuration are stored not on disk but in the registry (HKCU\Console\0 for shellcode, HKLM\SOFTWARE\IpDates_sun for C2 config), patched into a "FaCai2024" placeholder marker (Mandarin for "become prosperous") — a marker and registry technique previously documented by Tencent Security in connection with the distinct-but-related FaCai phishing group, providing a moderate-confidence attribution link. The implant establishes a dual-layer recovery architecture: an internal monitor routine checks the injected svchost.exe's exit code each cycle and recreates the payload if it is not STILL_ACTIVE, while an external batch-script watchdog (embedded as PE resource 4020) polls every 30 seconds via tasklist.exe/find.exe/timeout.exe and relaunches the loader if killed; a scheduled task (via schtasks.exe) additionally relaunches the loader chain at logon. Final C2 is ValleyRAT (aka Winos 4.0, Gh0st RAT lineage) beaconing to 43.128.26.132 over non-standard ports 778/779. ValleyRAT's broader plugin architecture (documented across independent reporting on this malware family) provides system reconnaissance, keylogging, screen/audio capture, credential theft, remote command execution, file exfiltration, and a kernel-mode "Driver Plugin" rootkit capability, indicating this Japan intrusion likely carries the same post-compromise capability set once the RAT is live.
SilverFox (aka Void Arachne, SwimSnake, The Great Thief of Valley, UTG-Q-1000) is a China-based intrusion set active since at least 2022 that increasingly blurs cybercrime and espionage-style operations, with a multi-year history of ValleyRAT/Winos 4.0 campaigns against Taiwan, India, and now Japan. Cato CTRL attempted coord
Weaknesses (CWE)
CWE-284, CWE-427, CWE-250, CWE-269
Target sectors: manufacturing, industrial, government administration, finance, technology, health
Target regions: japan, taiwan, india, malaysia, Southeast Asia, East Asia, South Asia
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 34 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2023-52271, T1583, T1608, T1566, T1204, T1106, T1129, T1543, T1053, T1574, T1543
