SHARE

The Rise of BYOVD: Silver Fox Abuses Vulnerable Microsoft-Signed Drivers

Silver Fox exploits a Microsoft-signed WatchDog driver to bypass defenses and deploy ValleyRAT malware, exposing gaps in endpoint security.

Written By

Ken Underhill

Sep 2, 2025

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

A new campaign highlights how attackers are abusing trust in Microsoft-signed drivers to bypass defenses and deliver malware.

Threat actor Silver Fox has been observed exploiting a vulnerable WatchDog Anti-malware driver to disable security solutions and deploy ValleyRAT, a remote access trojan that provides full control over compromised machines.

In its analysis, Check Point noted: “This campaign highlights a growing trend of weaponizing signed-but-vulnerable drivers to bypass endpoint protections and evade static detection.”

How the attack works and why it matters

The abuse of a signed driver not previously listed on Microsoft’s Vulnerable Driver Blocklist exposes a blind spot in traditional endpoint protection.

Organizations relying on signature-based defenses may be left unprotected, as the attackers leverage “bring your own vulnerable driver” (BYOVD) techniques to undermine core safeguards.

According to Check Point’s analysis, the campaign has already adapted to vendor patches, demonstrating a rapidly evolving threat landscape.

The campaign employs a dual-driver strategy. On Windows 7 hosts, attackers use a known-vulnerable Zemana driver, while Windows 10 and 11 systems are targeted with the newly abused WatchDog driver (amsdk.sys, version 1.0.600). Both drivers allow attackers to terminate arbitrary processes and escalate privileges.

This capability effectively neutralizes endpoint protections, clearing the way for malware deployment. The vulnerable driver also allows arbitrary process termination and local privilege escalation, giving attackers full control at the kernel level.

After bypassing defenses, the all-in-one loader installs ValleyRAT (also known as Winos 4.0), which can communicate with a command-and-control (C2) server, execute remote commands, and exfiltrate sensitive data. It includes anti-analysis features such as anti-VM and anti-sandbox checks, aborting execution if it detects defensive environments.

WatchDog released a patch (version 1.1.100) addressing the privilege escalation flaw through a stricter Discretionary Access Control List (DACL).

However, attackers quickly adapted by flipping a single byte in the driver’s timestamp field — retaining Microsoft’s signature while bypassing hash-based blocklists.

How organizations can respond

Silver Fox — also tracked as SwimSnake, Valley Thief, and UTG-Q-1000 — has been active since 2022, targeting primarily Chinese-speaking users through trojanized apps, phishing campaigns, and fake websites.

The group’s Finance Group sub-cluster has also been tied to financial fraud operations leveraging remote access trojans, phishing QR codes, and compromised social media accounts to drain victims’ bank accounts.

This case underscores a wider trend: attackers are moving beyond exploiting known weak drivers to weaponizing unknown but signed ones. Such abuse of trust in Microsoft’s signing process highlights the urgent need for proactive driver validation, anomaly detection, and defense-in-depth.

To defend against Silver Fox’s BYOVD campaign, security teams should act quickly. The following measures can help reduce exposure and strengthen resilience against driver-based attacks.

Patch to WatchDog version 1.1.100 or later to block privilege escalation.
Avoid relying only on signature-based detection for endpoint security.
Enforce strict driver loading policies and least privilege to limit abuse.
Watch for suspicious driver loads (amsdk.sys, zam.exe) and C2 connections.
Leverage the YARA rules provided by Check Point for detection.
Train teams with BYOVD attack scenarios in incident response playbooks.

As attackers refine BYOVD tactics, the security community must prioritize visibility into kernel-level threats and adopt layered defenses — because when trusted drivers turn malicious, conventional safeguards may fail silently.

When attackers can hijack even Microsoft-signed drivers, “good enough” security isn’t enough. See which EDR tools can help stop threats.

Ken Underhill

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.