SILVER FOX APT EXPLOITS SIGNED WINDOWS DRIVER TO DELIVER VALLEYRAT

Summary from the TLDR InfoSec newsletter

Silver Fox APT exploits a Microsoft-signed but vulnerable WatchDog Antimalware driver (amsdk.sys v1.0.600) to disable security processes on Windows 10/11 and deploy ValleyRAT malware, with the driver never being flagged by Microsoft's Vulnerable Driver Blocklist or LOLDrivers database. The attackers bypassed hash-based blocklists even after a patch by changing a byte in the driver's timestamp while keeping its valid Microsoft signature, showing how trusted signed drivers can be weaponized. The campaign exposes gaps in Microsoft's driver blocklist and the need for security teams to use additional verification beyond signature validation, as the malware terminated nearly 200 security processes targeting mainly Asian organizations.