Critical

SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Hacker News

July 30, 2026 at 10:32 AM

Actively Exploited

Overview

The Chinese cybercrime group Silver Fox has targeted a Japanese manufacturing company using a sophisticated attack method that involves exploiting vulnerable drivers. This approach, known as bring your own vulnerable driver (BYOVD), allows attackers to bypass security measures and install a remote access tool called ValleyRAT, which enables persistent access to the compromised systems. The campaign marks a notable shift in tactics, as the group is utilizing newly identified vulnerable drivers alongside legitimate software abuse. This incident raises concerns for the industrial sector, highlighting the need for stronger security protocols to protect against such advanced threats. Organizations in manufacturing and similar industries should be particularly vigilant and assess their defenses against these types of attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Japanese manufacturing systems, vulnerable drivers, ValleyRAT (Winos 4.0)
Action Required: Organizations should review and patch vulnerable drivers, enhance monitoring for unusual remote access, and strengthen endpoint security measures.
Timeline: Newly disclosed

Original Article Summary

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access. "In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate

Impact

Japanese manufacturing systems, vulnerable drivers, ValleyRAT (Winos 4.0)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should review and patch vulnerable drivers, enhance monitoring for unusual remote access, and strengthen endpoint security measures.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

CISA issues recommendations to federal agencies on open-source software security

CyberScoop

The Cybersecurity and Infrastructure Security Agency (CISA) has released new recommendations aimed at improving the security of open-source software used by federal agencies. This guidance includes best practices for managing vulnerabilities, particularly in open-weight AI models and the importance of timely patching. Experts in the field have expressed approval of these recommendations, noting that they address significant security concerns surrounding open-source software. The move is particularly relevant as more agencies adopt open-source solutions, which can be both beneficial and risky if not properly secured. By following CISA's advice, federal agencies can better protect their systems and data from potential threats.

Jul 30, 2026

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

The Hacker News

Researchers have linked a new macOS malvertising campaign to North Korean actors, who are using deceptive tactics to deliver malware. The attackers redirect users to fake web pages that mimic legitimate macOS update screens, tricking them into thinking they need to install an update. Once users interact with these screens, malware is installed on their devices, specifically designed to steal cryptocurrency. This campaign is a continuation of the ongoing Contagious Interview campaign, raising concerns about the security of macOS users who may fall victim to these tactics. It serves as a reminder for users to be cautious of unexpected update prompts and to verify the legitimacy of software updates before proceeding.

Jul 30, 2026

What the FCC ban on foreign-made robot vacuums means for your Roomba

Read This Before You Buy That TV Streaming Stick

Krebs on Security

Security experts have raised significant concerns about generic TV streaming devices that offer unlimited content for a one-time fee. These devices not only risk your internet connection being rented out to strangers but are also involved in more sophisticated scams. A recent analysis reveals that these devices often impersonate mobile phones to click on ads on AI-generated websites, which is part of a larger scheme to defraud online merchants and advertising networks. This poses a risk not only to users' personal data but also affects the integrity of online advertising systems, potentially leading to financial losses for companies and advertisers. Users should be cautious about using such devices and consider the broader implications for their online security.

Jul 30, 2026

OpenAI's rogue agent didn't stop at Hugging Face - here's what we know

After the Break-In: What Attackers Do Once They're Already Inside

BleepingComputer

Attackers often continue their malicious activities after they gain access to a network, rather than halting their operations. A recent analysis by Huntress examined a real-world intrusion, revealing how these threat actors establish long-term control within compromised systems, disable security measures, and manipulate the environment to their advantage. The findings emphasize that cybersecurity defenders need to focus on identifying and addressing the original entry points of attacks instead of merely removing malware. This approach is crucial because understanding how attackers infiltrate systems can help prevent future breaches and improve overall security posture. Organizations must prioritize thorough investigations and proactive measures to safeguard their networks against these persistent threats.

Jul 30, 2026