SilverFox Expands ValleyRAT with Kernel-Mode Rootkit in New Campaign

The SilverFox APT group has upgraded its ValleyRAT malware into a sophisticated eight-stage malware chain, culminating in a kernel-mode rootkit. This evolution enhances post-exploitation persistence and evasion techniques, making detection significantly more challenging. The malware targets corporate networks, indicating a focus on long-term access rather than immediate disruption. Security professionals are urged to be vigilant as this new strain exhibits behaviors not previously seen from SilverFox. The campaign is currently active, affecting various corporate environments, and poses a serious threat to organizational security.

Key Points: • SilverFox has transformed ValleyRAT into an eight-stage malware chain with a kernel-mode rootkit. • The new strain of ValleyRAT enhances evasion techniques, complicating detection efforts. • The campaign targets corporate networks, indicating a shift towards long-term access strategies.