This week, Tanium’s Cyber Threat Intelligence (CTI) team examines a new tool called HexStrike AI, which significantly reduces exploitation times from days to minutes. Next, the team gives an overview of TinkyWinkey: a Windows keylogger that is enabling espionage and data theft operations. Finally, we look at new research from Check Point detailing how the Silver Fox APT group successfully exploited a previously unknown, Microsoft-vulnerable driver to disable endpoint protections and deploy the ValleyRAT malware.
Threat actors use HexStrike AI to orchestrate cyberattacks
A recent Check Point post explores how threat actors are using a new AI tool called HexStrike AI to orchestrate cyberattacks. Threat actors claim that HexStrike AI reduces exploitation times from days to under 10 minutes.
What is HexStrike AI?
HexStrike AI was originally designed to be a tool for red teams and security researchers. Right after its release, Check Point observed malicious actors discussing how to weaponize the tool in attacks. In just a few hours, some actors were specifically discussing how to use it to exploit Citrix zero-day vulnerabilities that were disclosed about a week prior.
HexStrike AI architecture
Check Point describes HexStrike AI as a “fundamental shift in how offensive cyber operations can be conducted.” The tool enables various AI models like Claude, GPT, and Copilot to run tools without human interaction and management. It also introduces MCP agents, which are agents that communicate via the Model Context Protocol (MCP) and help bridge the gap between LLMs and real-world offensive capabilities. Check Point found that AI agents could autonomously run more than 150 cyber tools including those for pen testing, discovery, research, and more.
The report highlights a few key aspects of HexStrike’s design. The first is its MCP orchestration layer. The framework will set up a FastMCP server for communication between other LLMs and tool functions. The tools function as callable components that the agent can invoke and enable commands to be issued programmatically. Check Point also calls out its tool integration at scale. The tool is automated and resilient and abstracts commands into workflows so that actions are repeatable.
Vulnerability exploitation
Check Point highlights how actors were able to leverage HexStrike AI in the context of three zero-day vulnerabilities impacting Citrix NetScaler ADC and Gateway appliances, released shortly before.
In the 12 hours after these vulnerabilities were disclosed, Check Point observed actors chatting about how HexStrike AI could be used to help scan for and exploit vulnerable instances. This reiterates how AI can be used to automate previously manual tasks like reconnaissance.
Analyst comments from Tanium’s Cyber Threat Intelligence team
HexStrike AI is a prime example of how AI can be a force multiplier for threat actors, reducing the time, skill, and effort required to conduct sophisticated attacks.
Check Point highlights how fast threat actors flocked to this tool after its release, and how quickly it was being discussed for help with real world zero-day exploitation. The speed at which attackers are operationalizing AI tools is becoming faster, which becomes particularly concerning as AI is slowly becoming something that can be leveraged to run operations and execute full kill chains.
Check Point includes some recommended action items defenders can take regarding this threat.
TinkyWinkey keylogger threatens Windows systems
Cyfirma is sharing details of the TinkyWinkey keylogger, a stealthy Windows-based malware that captures keystrokes, monitors active windows, and collects system data using advanced techniques like DLL injection and low-level API calls. Its modular design and persistent execution make TinkyWinkey a significant threat for espionage and data theft operations.
TinkyWinkey overview
Cyfirma first observed the TinkyWinkey keylogger at the end of June 2025. According to Cyfirma, its “service and keylogger components suggests a deliberate effort to maintain flexibility and stealth, making it easier to update or repurpose the malware for different campaigns.”
TinkyWinkey’s two main components are:
- The Tinky service, which is responsible for launching and running the keylogger
- The Winkey keylogger, which captures actual keyboard strokes
Cyfirma notes that the malware’s key features include system information gathering, keylogging, Window tracking, logging system, service management, and process/session management.
TinkyWinkey static analysis
First, the malware will obtain the system’s temporary directory and ensure the necessary log file is there. This log file is where the captured keystrokes will be stored as part of its keylogging routine. It then invokes a few functions specifically for gathering information about the host like OS version, processor information, etc.
Next the malware will fingerprint the operating system, enumerate CPU information, perform network identity discovery, enumerate memory capacity, and monitor the foreground window to determine when the user switches applications.
For the main keylogging feature, the malware installs a keyboard hook that will capture the keystrokes. It can monitor the active keyboard but can also log if the user happens to switch languages. Special keys such as Escape, Enter, or Backspace are replaced with descriptive markers in the actual log. For non-special keys, the malware converts the key code and stores it in the log file.
The malware will finally enter a continuous message loop, which keeps its foreground window and keyboard hooks active for persistence.
TinkyWinkey dynamic analysis
When executed, a malicious Windows service called Tinky is registered. This is created to be invoked at startup for persistence.
After successfully establishing persistence, the secondary payload, winkey.exe, is executed. This payload is the one responsible for the keylogging module.
Analyst comments from Tanium’s Cyber Threat Intelligence team
TinkyWinkey’s advanced use of Windows internals, stealthy execution, and comprehensive logging make it likely to appeal to threat actors.
As Cyfirma points out, the actor behind the keylogger clearly separated the service and keylogger components. This intentional separation will help the actor in terms of flexibility and future updates to the malware. That said, it would not be surprising to see new iterations or variants of this malware in the future.
Silver Fox APT exploits vulnerable driver to disable endpoint security
A new Check Point report explains how the Silver Fox APT group exploited a previously unknown, Microsoft-signed vulnerable driver to stealthily disable endpoint protections and deploy the ValleyRAT malware.
The campaign highlights critical gaps in driver trust models and the limitations of signature-based defenses in modern cybersecurity.
Key findings from Check Point’s Silver Fox APT report
Starting in late May, Check Point came across a Silver Fox campaign that targeted Windows devices with a custom loader. This custom loader specifically abused kernel drivers to kill security processes. A full list of terminated processes can be found in the report.
According to Check Point, this campaign “marked a significant shift from using only known vulnerable drivers to deploying a previously unclassified, signed vulnerable driver that bypassed traditional detection mechanisms.”
Silver Fox deployed the WatchDog antimalware driver during the attack, which wasn’t publicly known to be vulnerable and is legitimately signed by Microsoft. This driver, plus another deployed driver that was known to be vulnerable, enabled arbitrary process termination. The final payload in the attack is the ValleyRAT backdoor, which is capable of data exfiltration, command execution, etc. and helped attribute the attack to Silver Fox.
The C2 servers in the attack were all hosted in China and used public cloud or web services. From a victimology standpoint, Check Point observed a global targeting pattern.
The loader
Check Point identified several all-in-one loader samples used by Silver Fox APT, each designed for stealth, persistence, and payload delivery. These loaders include anti-analysis routines that detect virtual environments, sandboxes, and specific ISPs—aborting execution if flagged. They also establish persistence by creating a RunTime folder and registering services to ensure execution at startup.
The loader embeds two vulnerable drivers as encoded byte strings: one tailored to disable endpoint defenses and another to deploy the ValleyRAT backdoor. The appropriate driver is selected based on the Windows version of the target system, allowing the malware to adapt across environments while evading traditional detection mechanisms.
EDR/AV killer
As noted, the routine for the EDR/AV killer is embedded within the loader. The appropriate vulnerable driver will be dropped depending on what version of Windows the infected device is running.
Regardless of the driver used, Windows API functions are used to create the necessary services. The main logic will “iterate over a Base64-encoded list of target processes to be terminated,” which contains 192 process names. If there is a match, the process will be terminated.
New vulnerable driver
Check Point took a closer look at the vulnerable driver that was not previously known to be vulnerable. This is the WatchDog antimalware driver that is legitimately signed.
This driver, which is based on the Zemana Anti-Malware SDK, can terminate arbitrary processes without having to confirm if that process is running as protected—making it work well for the bring your own vulnerable driver technique.
ValleyRAT backdoor
All of the samples Check Point analyzed ended in the ValleyRAT backdoor being deployed. To avoid detection, it will invoke a callback via the Windows API to detect processes associated with analysis tools. If detected, it will delay its execution with a 20 second sleep and will keep enumerating until no tools are detected.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The abuse of Microsoft-signed drivers underscores a systemic vulnerability in how trust is assigned in Windows environments. The assumption that signed equals safe is being manipulated more often by attackers.
In this attack, the actor terminated anti-malware solutions which helped evade detection without triggering alerts. This highlights the need for monitoring beyond just file signatures to things like driver behavior.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.