SilverFox Built Fake Software Sites That Know When Researchers Are Watching
Silver Fox operators delivered a Windows loader via WhatsApp while hiding payloads from security researchers.
61
Malware
ValleyRAT
- Mentions · 7d0
- Mentions · 30d0
- All mentions8
- First seenAug 18, 2026
- Last mentionedSep 29, 2026
Timeline
8 articles · newest firstSecurity Affairs newsletter Round 593 by Pierluigi Paganini
Security Affairs weekly newsletter round 593 linking to dozens of stories across breaches, ransomware, malware, APTs, and AI security news.
15
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Fake software-download sites distribute installers that disable Windows Update and weaken Defender, attributed to China-linked cluster Silver Fox.
68
ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool
Kaspersky details ValleyRAT delivered via trojanized QN Wallpaper using DLL sideloading, tied to Silver Fox and hitting 1,500+ users in China and India.
55
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.
62
ValleyRAT masquerading as adware
Kaspersky reports threat actors distributing the ValleyRAT backdoor disguised as adware, tracing the infection chain to the final payload.
45
Silver Fox Targets Japanese Manufacturer with 3
Chinese group Silver Fox used new vulnerable drivers and DLL side-loading to deploy ValleyRAT at a Japanese industrial manufacturer.
58
New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
40
Appears with
- Silver Foxthreat actor · 6
- Kasperskyvendor · 5
- Microsoft Defenderproduct · 2
- Cato Networksvendor · 2
- QN Wallpaperproduct · 2
- Manchester Airports Groupvictim · 1
- DCRatproduct · 1
- NCC Grouporganization · 1
- Gh0st RATproduct · 1
- CISAorganization · 1
- Cato CTRLorganization · 1
- Kaijimalware · 1
- Darktracevendor · 1
- Silver Fox trojanmalware · 1
- Yinhuthreat actor · 1
- SonicWallvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.