type: incident · created: 2026-07-30 · updated: 2026-08-18 · tags: [cyber, digest-2026-07-31, silverfox, byovd, valleyrat, japan, manufacturing, cybercrime] · confidence: not-rated · affected_sectors: [] · au_impact: false
🎯 IOCs · ValleyRAT
Indicators of compromise · ValleyRAT — 4 shown
205[.]186[.]112[.]235:443hxxp://ruihankj[.]top/getinstall64hxxp://fafdafaf[.]shop/getinstall64hxxp://fdsfsffdsf[.]shop/getinstall64
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT
Summary
The Chinese cybercrime group Silver Fox (SilverFox) has been observed using new bring-your-own-vulnerable-driver (BYOVD) techniques targeting a Japanese industrial manufacturing organisation. The attack chain begins with an invoice-themed phishing lure, uses DLL sideloading via QQ and Tencent Cloud services, deploys three drivers for kernel access, and ultimately delivers ValleyRAT (Winos 4.0) for persistent remote access.
Key Details
- Date: 2026-07-30
- Source: The Hacker News
- Reliability: Tier 2/4 — Established cyber journalism
- Threat Actor: Silver Fox (SilverFox) — Chinese cybercrime group
- Target: Japanese industrial manufacturing organisation
- Initial Access: Invoice-themed phishing lure
- Technique: DLL sideloading via QQ and Tencent Cloud services
- Exploitation: 3-driver bring-your-own-vulnerable-driver (BYOVD) chain for kernel access
- Payload: ValleyRAT (Winos 4.0) — persistent remote access
Source
See Also
- Hackers Exploit AnySign4PC via Compromised Korean Websites to Install Backdoors
- DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
- Cyber Extortionists Steal Data from UK Department for Education