Invoice Phish Drops ValleyRAT via BYOVD Drivers

How the attack worked

This campaign, attributed to the Silver Fox group, targeted a Japanese industrial manufacturer through an invoice themed phishing message. The lure directed the recipient to a ZIP archive hosted on legitimate QQ and Tencent Cloud infrastructure rather than an attacker owned domain, which likely helped it slip past reputation based filtering. Inside the ZIP was a downloader that retrieved additional components needed for DLL sideloading.

The sideloading relied on legitimate executables named ConvertToPDF.exe and PDFDirect.exe, which loaded a malicious DLL called PDFCORE8.dll. That DLL embedded three vulnerable drivers as part of a modular bring your own vulnerable driver, or BYOVD, framework used to weaken endpoint security controls. The malware also performed NTDLL unhooking and process injection, and stored payload data in the registry to reduce its footprint on disk. The final stage was ValleyRAT, also known as Winos 4.0, giving the attacker persistent remote access.

Why it succeeded

The attack chain combined a familiar pretext, an invoice needing review, with technical evasion that most users and even many security tools would not immediately flag. Hosting the payload on well known cloud services made the initial link look benign. The requirement to run an executable to view a converted PDF is a step outside a normal document workflow, but framed as a conversion tool it can appear routine to a busy finance or procurement employee.

What to watch for

• Unexpected invoices, especially those arriving as ZIP attachments
• Instructions to run a program such as ConvertToPDF.exe or PDFDirect.exe to view a document
• Links to cloud storage or messaging platforms not normally used for vendor invoices
• Endpoint infections that reappear shortly after being removed

Building resistance

Organizations in finance, accounts payable, procurement, and manufacturing administration roles are the most likely targets for this kind of lure. Building resistance starts with treating unexpected invoice attachments, particularly ZIP files, as high risk and verifying them with the sender through a known contact channel rather than replying to the email. Staff should also be trained to question document workflows that require executing a program instead of simply opening a file.

Because this malware includes a dual watchdog design, with a scheduled task and an internal monitor working together, a single cleanup attempt may not fully remove it. Security teams should escalate any endpoint that shows repeated reinfection rather than assuming a single removal was successful. Reviewing detections against MITRE ATT&CK techniques such as T1566.001, T1204.002, and T1574.002 can help teams map their existing controls against this specific chain.

How did the attack start?

It began with an invoice-themed phishing lure that pointed victims to a ZIP archive hosted on legitimate QQ and Tencent Cloud services, which then triggered a DLL sideloading chain.

What malware was ultimately installed?

The final payload was ValleyRAT, also known as Winos 4.0, which provides persistent remote access and command and control to the attacker.

Why is this attack hard to remove once it infects a system?

The malware uses a dual watchdog design, including a scheduled task and an internal monitor, so terminating one component alone may not fully remove the infection.

What is BYOVD and why does it matter here?

BYOVD means bring your own vulnerable driver. The malicious DLL embeds vulnerable drivers as a modular framework to weaken security controls on the endpoint.