ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox distributes ValleyRAT via signed QN Wallpaper adware, sideloading a malicious libcef.dll into a trusted process to evade defenses.
Kaspersky reports the Silver Fox threat actor disguising the ValleyRAT backdoor (Winos 4.0) inside a modified, signed copy of the QN Wallpaper adware tool, using DLL sideloading to run within a trusted process. The installer disables Windows Defender via the DisableAntiSpyware registry key, adds autorun entries, and elevates via runas when needed; ValleyRAT steals keystrokes, clipboard data, and screenshots and can mark its process critical to trigger BSOD if killed. Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users in 2026, mostly in China and India, with prior campaigns against Japan, India, and Russia.
- Malicious libcef.dll sideloaded by signed QnWallpaper.exe executes without tripping signature-based controls.
- ValleyRAT provides full machine control, capturing keystrokes, clipboard, and screenshots, and loading extra modules.
- Installer disables Windows Defender, sets autorun persistence, and relaunches with runas for admin rights.
- C2 servers 103.45.66.18 (ports 441-443) and 192.253.225.173 (ports 6666, 8888); decoy opens meeting.tencent[.]com.
- Kaspersky logged 100,000+ detections across 1,500+ users in 2026; technique also seen in Cato Networks' Japan case.
- ATT&CK
- T1574.002 DLL Side-LoadingT1562.001 Disable or Modify ToolsT1547.001 Registry Run Keys / Startup Folder
- Vendors
- KasperskyCato Networks
- Products
- QN WallpaperMicrosoft Defender
- Threat actors
- Silver Fox
From the original article
3 min read at thehackernews.com
Swati Khandelwal Aug 31, 2026 Malware / Endpoint Security The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.