Researchers reported a real campaign by the China-based Silver Fox group against a Japanese industrial manufacturer. The attack starts with an invoice-themed phishing message that leads victims to open a ZIP file, triggering a DLL sideloading chain and installing ValleyRAT for persistent remote access. The malware also abuses vulnerable drivers to weaken security controls and includes recovery mechanisms that relaunch components if defenders try to kill them.
This campaign, attributed to the Silver Fox group, targeted a Japanese industrial manufacturer through an invoice themed phishing message. The lure directed the recipient to a ZIP archive hosted on legitimate QQ and Tencent Cloud infrastructure rather than an attacker owned domain, which likely helped it slip past reputation based filtering. Inside the ZIP was a downloader that retrieved additional components needed for DLL sideloading.
The sideloading relied on legitimate executables named ConvertToPDF.exe and PDFDirect.exe, which loaded a malicious DLL called PDFCORE8.dll. That DLL embedded three vulnerable drivers as part of a modular bring your own vulnerable driver, or BYOVD, framework used to weaken endpoint security controls. The malware also performed NTDLL unhooking and process injection, and stored payload data in the registry to reduce its footprint on disk. The final stage was ValleyRAT, also known as Winos 4.0, giving the attacker persistent remote access.
The attack chain combined a familiar pretext, an invoice needing review, with technical evasion that most users and even many security tools would not immediately flag. Hosting the payload on well known cloud services made the initial link look benign. The requirement to run an executable to view a converted PDF is a step outside a normal document workflow, but framed as a conversion tool it can appear routine to a busy finance or procurement employee.
Organizations in finance, accounts payable, procurement, and manufacturing administration roles are the most likely targets for this kind of lure. Building resistance starts with treating unexpected invoice attachments, particularly ZIP files, as high risk and verifying them with the sender through a known contact channel rather than replying to the email. Staff should also be trained to question document workflows that require executing a program instead of simply opening a file.
Because this malware includes a dual watchdog design, with a scheduled task and an internal monitor working together, a single cleanup attempt may not fully remove it. Security teams should escalate any endpoint that shows repeated reinfection rather than assuming a single removal was successful. Reviewing detections against MITRE ATT&CK techniques such as T1566.001, T1204.002, and T1574.002 can help teams map their existing controls against this specific chain.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It began with an invoice-themed phishing lure that pointed victims to a ZIP archive hosted on legitimate QQ and Tencent Cloud services, which then triggered a DLL sideloading chain.
The final payload was ValleyRAT, also known as Winos 4.0, which provides persistent remote access and command and control to the attacker.
The malware uses a dual watchdog design, including a scheduled task and an internal monitor, so terminating one component alone may not fully remove the infection.
BYOVD means bring your own vulnerable driver. The malicious DLL embeds vulnerable drivers as a modular framework to weaken security controls on the endpoint.
You get an email: "Subject: Invoice attached – please review and confirm." ZIP file attached. Looks routine, right? You open the ZIP and instead of a PDF, there’s ConvertToPDF.exe or PDFDirect.exe. Run it, and a hidden PDFCORE8.dll starts a chain that drops ValleyRAT and weakens your security tools using old drivers. Behind the scenes, it abuses QQ/Tencent Cloud links, unhooks NTDLL, injects into other processes, hides payloads in the registry, and even sets watchdog tasks so it restarts if IT kills it. Here’s the move: if an "invoice" comes as a ZIP and wants you to run an EXE to see the PDF, stop and call the sender using their known number before you open anything.
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
Researchers tied North Korea’s Lazarus Group to a real-world campaign that approaches professionals with convincing fake recruiter outreach and job offers. Victims are tricked into opening a malicious PDF or installing a fake PDF viewer from lookalike websites, which then installs backdoors and can…
Researchers describe BraZetsu, a Windows malware framework used by an initial-access broker to turn infected PCs into "access for sale" on a criminal marketplace. While the malware itself is technical, the article includes real-world delivery details pointing to phishing: victims are tricked into…
The report describes confirmed phishing activity targeting the financial sector, where victims were tricked into fake login pages via emails, links, or HTML attachments. The credentials entered were then exfiltrated to attackers through Telegram using APIs. The same report also highlights ongoing…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
This roundup describes multiple real-world campaigns where attackers trick people into installing malicious software that looks legitimate (a fake Claude desktop app, a fake emergency alert app, and banking-malware phishing). The common pattern is “looks normal, feels urgent,” leading users to…
