SilverFox Hijacks Trusted Software and Kernel Drivers to Disable Security Tools

SilverFox has expanded its malware toolkit in a campaign that targeted a Japanese industrial manufacturer. The attackers used a fake invoice email to lure a recipient into downloading a ZIP archive hosted through services that normally appear legitimate. The attack then used trusted software to load a malicious component without changing the signed application itself. This method, known as DLL sideloading, lets attackers blend harmful code into ordinary Windows activity, much like the techniques seen in this AsyncRAT DLL sideloading campaign. Analysts at CATO Networks identified the activity and linked it to SilverFox with moderate-to-high confidence. CATO Networks said in a report shared with Cyber Security News (CSN)...

Read the full article at the source.