Malware

ValleyRAT

0 mentions in 7 days · 7 in 30 days · 7 total · first seen Aug 18, 2026 · last 9d ago

Timeline7 articles

Security Affairs newsletter Round 593 by Pierluigi Paganini

Security Affairs weekly newsletter round 593 linking to dozens of stories across breaches, ransomware, malware, APTs, and AI security news.

This is the weekly Security Affairs newsletter aggregation (round 593) with a list of headlines: Manchester Airports Group breach (8.8M people), Aurora ransomware targeting ESXi, active exploitation of PaperCut and SonicWall SMA 1000 zero-days, Chrome V8 zero-day patching, Pegasus spyware of Serbian activists, and DPRK APT activity against South Korea. It is an index page rather than a standalone story.

Security AffairsSep 6, 07:56 UTC · 9d agoOther

Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.

Microsoft says an active campaign uses counterfeit vendor websites on .com.cn and .hl.cn infrastructure with Chinese-language lures to deliver server-side generated installers that establish scheduled-task persistence, add Defender exclusions, delete shadow copies, and stop services including wuauserv, UsoSvc, uhssvc and WaaSMedicSvc. Victims span healthcare, manufacturing, gaming, technology, logistics, government and education, primarily China-based operations of multinationals and Chinese-speaking users. Microsoft assesses with moderate confidence the activity matches the Silver Fox (Yinhu) cluster, historically tied to Gh0st RAT and ValleyRAT, with C2 over non-standard ports like 5090 and 7088-7090 via domains iualef[.]net and oijfwe[.]net. Kaspersky separately detailed a QN Wallpaper DLL-sideloading chain delivering ValleyRAT.

The Hacker NewsSep 2, 16:41 UTC · 13d agoMalware in the wild

ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool

Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.

Kaspersky found a malicious installer abusing a modified version of the legitimate QN Wallpaper adware application to deliver the ValleyRAT backdoor via DLL sideloading of libcef.dll. The installer masquerades as DingTalk, Chrome or Tencent Meeting software, creates persistence, disables Windows Defender via the DisableAntiSpyware registry key, and loads AES-encrypted payloads. ValleyRAT collects keystrokes, clipboard contents and screenshots plus system details, can download additional modules, and resists removal by injecting into svchost.exe or marking its process critical. The campaign was detected over 100,000 times in 2026, affecting more than 1,500 users mainly in China and India, and is attributed to Silver Fox with both espionage and financial motives.

Security AffairsAug 31, 19:45 UTC · 15d agoMalware in the wild

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.

Kaspersky reports the Silver Fox threat actor disguising the ValleyRAT backdoor (Winos 4.0) inside a modified, signed copy of the QN Wallpaper adware tool, using DLL sideloading to run within a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds autorun entries, and elevates via runas when needed; ValleyRAT steals keystrokes, clipboard data, and screenshots and can mark its process critical to trigger BSOD if killed. Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users in 2026, mostly in China and India, with prior campaigns against Japan, India, and Russia.

The Hacker NewsAug 31, 12:14 UTC · 15d agoMalware in the wild

ValleyRAT masquerading as adware

Kaspersky reports threat actors distributing the ValleyRAT backdoor disguised as adware, tracing the infection chain to the final payload.

Kaspersky researchers analyzed a campaign distributing the ValleyRAT backdoor under the guise of adware. The write-up documents the complete infection chain, from the malicious installer through deployment of the final backdoor payload. ValleyRAT is a remote access tool typically used by criminal actors for surveillance and data theft.

Kaspersky SecurelistAug 31, 10:00 UTC · 15d agoMalware in the wild

Silver Fox Targets Japanese Manufacturer with 3

Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.

Cato Networks detailed a Silver Fox campaign against a Japanese industrial manufacturing organization combining new vulnerable-driver abuse (BootRepair.sys and EnPortv.sys alongside wsftprm.sys), DLL side-loading via Zeon Corporation PDF binaries, and NTDLL unhooking to deliver ValleyRAT (Winos 4.0), a Gh0st RAT variant. The chain starts with an invoice-themed phishing lure hosting attacker-controlled content on legitimate QQ and Tencent Cloud services. Shellcode is injected into svchost.exe via thread-context hijacking, and a dual watchdog design pairs payload monitoring with a scheduled-task batch script for persistence. A separate 180-day VirusTotal retrohunt found 146 Atlas RAT samples across six PDB builds, though the Silver Fox link remains circumstantial.

The Hacker NewsAug 27, 10:50 UTC · 19d agoThreat actor in the wild

New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.

Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.

The Hacker NewsAug 18, 12:13 UTC · 28d agoMalware1

Appears with

threat actor Silver Fox 5 vendor Kaspersky 5 product QN Wallpaper 2 product Microsoft Defender 2 vendor Cato Networks 2 malware Chaos 1 malware Atlas RAT 1 threat actor Mirage Kitten 1 malware Pegasus 1 malware Kaiji 1 malware Silver Fox trojan 1 malware Ted backdoor 1 malware Winos 4.0 1 organization Cato CTRL 1 threat actor Yinhu 1 malware Gh0st RAT 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.