Hackers Unleash ValleyRAT with a Twist: The Not-So-Secure WatchDog Driver Exploit
Silver Fox APT is using a sneaky trick: a Microsoft-signed but vulnerable WatchDog driver to disable Windows security and install ValleyRAT malware. Even when patched, they cleverly tweak a single byte to bypass protections, leaving Windows trusting the driver. It’s a twisty tale of tech maneuvering with a dash of mischief!
Hot Take:
Who knew that something called a “WatchDog” would be more like a “WatchOut”? Silver Fox APT has officially redefined the term “driver’s license” by giving themselves unrestricted access to your system! Microsoft, time to hit the brakes on these loophole joyrides!
Key Points:
- Silver Fox APT is exploiting a signed but vulnerable driver, WatchDog, to disable Windows security.
- The WatchDog driver was never flagged by Microsoft’s or community-driven blocklists.
- Silver Fox uses a modified driver to bypass hash-based blocklists without breaking its valid signature.
- ValleyRAT malware is deployed as the final payload, targeting antivirus processes, especially in Asia.
- Microsoft’s infrequent updates to their blocklist create opportunities for such attacks.
Already a member? Log in here