A new threat has emerged from the cyber landscape as the threat actor known as Silver Fox has been distributing the ValleyRAT backdoor, cleverly disguised within a signed Chinese adware application. This strategy allows the malware to operate under trusted processes, bypassing user security by adding itself to antivirus exclusions.
The Mechanism Behind ValleyRAT
Security experts at Kaspersky have identified this malicious tactic, highlighting how ValleyRAT is concealed within QN Wallpaper, a legitimate Chinese desktop wallpaper tool. Typically, this application functions as adware, bundling partner software and displaying ads. However, when modified, it grants attackers full control over compromised systems, with the attack likely orchestrated by Silver Fox.
ValleyRAT, also known as Winos 4.0, is a sophisticated backdoor with capabilities to gather sensitive information such as keystrokes and clipboard contents, take screenshots, and deploy additional harmful modules. The use of DLL sideloading enables the execution of malicious code within a signed, trusted process, allowing it to evade detection.
Technical Details and Indicators of Compromise
The malware’s installer packs a modified version of QN Wallpaper, executing its signed file, QnWallpaper.exe, which in turn loads a malicious libcef.dll located in the same directory. This process circumvents security controls by running under a legitimate application signature.
Before the adware component begins its activities, the installer disables Windows Defender via the DisableAntiSpyware registry key and sets the program to run automatically. If the user lacks administrative privileges, the malware uses the runas command to escalate its permissions. Additionally, ValleyRAT can mark its process as critical, causing a system crash if termination is attempted.
Kaspersky provided several indicators of compromise, including specific hashes, command-and-control server IPs, and domains involved in the attack chain. These indicators offer a roadmap for identifying and mitigating the threat.
Impact and Mitigation Strategies
The use of signed, legitimate software for DLL sideloading is not new for Silver Fox. A previous campaign targeting a Japanese firm also employed similar tactics. Kaspersky’s findings are based on an analysis of a single installer submitted by a customer, indicating a broader, yet undetermined scope of attack.
Throughout 2026, more than 100,000 detections of ValleyRAT and related malware were recorded by Kaspersky, affecting over 1,500 users, predominantly in China and India. This data encompasses all ValleyRAT activities for the year, not just the current campaign.
Organizations are advised to establish stringent policies on the use of third-party software and to educate employees about potential risks. Kaspersky strongly recommends that individual users avoid installing software with dubious reputations and never include them in security tool exclusion lists.
