Full Report
FortiGuard Labs analyzes Winos 4.0 (ValleyRat) campaigns targeting Taiwan, detailing phishing lures, DLL sideloading, BYOVD abuse, and evolving attacker infrastructure
Analysis Summary
# Incident Report: Winos 4.0 (ValleyRat) Targeted Campaigns
## Executive Summary
FortiGuard Labs identified a series of targeted phishing campaigns by the threat actor "Silver Fox" targeting organizations in Taiwan. The attacks utilize tax-themed lures to distribute the Winos 4.0 (ValleyRat) malware via multi-stage infection chains involving DLL sideloading and BYOVD (Bring Your Own Vulnerable Driver) techniques. The primary impact includes system compromise, persistence, and potential data exfiltration or widespread file encryption.
## Incident Details
- **Discovery Date:** February 20, 2026 (Reported)
- **Incident Date:** Late 2025 - Early 2026
- **Affected Organization:** Various (Targeted entities in Taiwan)
- **Sector:** Government, Finance, and general Business sectors
- **Geography:** Taiwan
## Timeline of Events
### Initial Access
- **Date/Time:** Approximately December 2025 - February 2026.
- **Vector:** Phishing via email and malicious URLs impersonating official Taiwanese government domains.
- **Details:** Attackers used lures such as tax audit notifications and e-invoice software. Campaigns leveraged hijacked or spoofed domains (e.g., `taxfnat[.]tw`) to host archives containing malicious LNK files or weaponized installers.
### Lateral Movement
- **Details:** While the report focuses on the initial compromise and persistence, the deployment of Winos 4.0 provides attackers with remote control capabilities, facilitating internal reconnaissance and the potential for lateral movement via credential harvesting.
### Data Exfiltration/Impact
- **Details:** Winos 4.0 executes shellcode to gain full control of the host. The malware can encrypt files (Ransomware-style behavior) and steal sensitive information to be used in follow-on attacks.
### Detection & Response
- **Detection:** Identified by FortiGuard Labs through analysis of rotating infrastructure and telemetry on "Silver Fox" threat actor activities.
- **Response:** Fortinet updated security signatures and IP reputation databases to block known IOCs and infrastructure.
## Attack Methodology
- **Initial Access:** Phishing (Tax-themed lures), Malicious LNK files in RAR/7z archives.
- **Persistence:** Implementation of Winos 4.0 (ValleyRat) backbone and scheduled tasks.
- **Privilege Escalation:** Use of BYOVD (Bring Your Own Vulnerable Driver) via `wsftprm.sys` to gain kernel-level access.
- **Defense Evasion:** DLL Sideloading (e.g., `AISafeSDK64.dll`), binary masquerading (renaming `curl.exe` to `url.exe`), and kernel-level driver abuse to kill security processes.
- **Credential Access:** Potential via plugins deployed by the Winos 4.0 framework.
- **Discovery:** Use of system utilities to map the environment; automated C2 check-ins.
- **Lateral Movement:** Remote access Trojan (RAT) functionality.
- **Collection:** Malware extracts resources from "EXPAND" sections of installers and downloads secondary payloads.
- **Exfiltration:** Communication with C2 via rotating domains and cloud services (e.g., Shanghai-based TOS cloud).
- **Impact:** System compromise, data theft, and potential mass file encryption.
## Impact Assessment
- **Financial:** High potential cost due to business disruption and remediation.
- **Data Breach:** High risk; the malware is designed for data collection and persistent access.
- **Operational:** Disruption of tax-related business processes and potential loss of file access.
- **Reputational:** High for organizations perceived as failing to secure official financial communications.
## Indicators of Compromise
### Network Indicators
- `bqdrzbyq[.]cn`
- `taxfnat[.]tw`
- `njhwuyklw[.]com`
- `twtaxgo[.]cn`
- `47[.]76[.]86[.]151`
### File Indicators (SHA256)
- `64ee7a2e6259286311c8ba1c7b6d30e1e52fe78befcfd1b71b291c788f3e3e6a` (Setup.exe)
- `156f31b37ee0d6e7f87cdc94dcd2d3b084b2e15da08bd8588e17d6bdc43159fe` (AISafeSDK64.dll)
### Behavioral Indicators
- Creation of directories in `%public%\501` or `C:\ProgramData\Golden`.
- Execution of `cmd.exe` from a relative path within an archive.
- Unauthorized loading of `wsftprm.sys` driver.
## Response Actions
- **Containment:** Blocking of identified malicious domains and IPs at the perimeter.
- **Eradication:** Removal of malicious directories and registry keys associated with Winos 4.0.
- **Recovery:** Restoring systems from clean backups and resetting credentials across the environment.
## Lessons Learned
- **Static Defenses are Insufficient:** The attacker's use of rotating domain infrastructure and cloud hosting requires dynamic, behavior-based security.
- **Driver Abuse:** The Bring Your Own Vulnerable Driver (BYOVD) technique remains a highly effective method for bypassing modern EDR solutions.
- **Human Element:** Phishing lures targeting specific local events (tax season) remain highly effective.
## Recommendations
- **Endpoint Protection:** Implement EDR policies that block the loading of known vulnerable drivers.
- **Email Security:** Use Content Disarm and Reconstruction (CDR) to strip active code from attachments.
- **Network Security:** Monitor for unusual outbound traffic to cloud storage providers not typically used by the organization.
- **User Training:** Conduct specific phishing simulations focused on high-pressure lures like tax audits or government notifications.