Loading story…
Threat actors have launched multiple campaigns distributing the ValleyRAT remote access trojan (RAT), targeting both organizations in China and job seekers. In one campaign, the group known as Silver Fox used search engine optimization (SEO) poisoning and fake Microsoft Teams installers to lure Chinese-speaking users, including those in Western companies operating in China, into downloading a trojanized setup file. The installer, disguised with Russian linguistic elements to mislead attribution, deploys ValleyRAT, which enables remote control, data exfiltration, and persistent access to infected systems. The malware loader checks for security software like 360 Total Security and manipulates Microsoft Defender exclusions to evade detection.
A separate ValleyRAT campaign has been observed targeting job seekers via malicious emails that leverage a weaponized Foxit PDF Reader for DLL side-loading. This campaign uses social engineering to trick users into executing the malware, which then allows attackers to monitor activity, steal sensitive data, and potentially compromise HR professionals as well. Both campaigns demonstrate a high level of sophistication, utilizing layered obfuscation, dynamic execution techniques, and strategic targeting to maximize infection rates and evade security controls. Security vendors have updated detection and hunting capabilities to address these threats, emphasizing the need for vigilance among organizations and individuals alike.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Hacker News reported that Silver Fox was using Russian-language elements and infrastructure in a false-flag effort to resemble a Russian threat group while conducting the ValleyRAT campaign in China. The report also highlighted the campaign's targeting, malware chain, and attribution details.
Trend Micro disclosed research on a related ValleyRAT/PureRAT campaign that targeted job seekers and abused Foxit PDF Reader for DLL side-loading. The report publicly documented the malware delivery technique and victim lure used in the operation.
During the November 2025 campaign, Silver Fox distributed trojanized Microsoft Teams and Telegram installers to infect victims with ValleyRAT. The infection chain included DLL side-loading, persistence mechanisms, remote access capabilities, and in some cases BYOVD to disable or evade security tools.
In November 2025, the threat actor Silver Fox launched a campaign targeting Chinese-speaking users and Western organizations operating in China. The operation used SEO poisoning and software-themed lures to deliver ValleyRAT/Winos 4.0 for espionage and financial gain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Breakglass Intelligence linked multiple March and April malware waves to the **SilverFox** threat actor, describing a broad Chinese-language campaign built around **ValleyRAT** on the `Winos4.0` framework and supported by **Gh0stRAT** and **RustyStealer**. The operation used emotionally charged lures tied to layoffs, disciplinary notices, scam-compound violence, banking fraud, censorship-bypass tools, fake utilities, and business apps, with delivery through WinRAR self-extracting archives, MSI and ZIP packages, DLL sideloading, process hollowing, and staged downloads. One ValleyRAT chain disguised itself as a WeChat-related document, extracted files into `C:\WeChat\`, launched a legitimate WeChat binary as a decoy, and then decrypted and injected the payload while applying Chinese-locale geofencing, anti-VM, and anti-debug checks. Researchers said the malware families provided complementary functions including remote access, keylogging, screenshot capture, clipboard hijacking, credential theft, and persistence, and that targeting extended from mainland Chinese users to diaspora communities, Taiwanese organizations, and some healthcare entities in North America. The infrastructure behind the campaign scaled rapidly, with reporting tying the activity to **22 to 75 command-and-control endpoints** and more than 17 domains across Alibaba Cloud, Tencent Cloud, AWS Hong Kong, Vultr, Azure, Huawei Cloud, and other providers, with Hong Kong serving as a major hub. Analysts connected the clusters through shared protocol behavior, mutexes, ValleyRAT DLL exports, recurring registrar patterns, use of the `codemark` builder variant, and repeated OPSEC failures including exposed RDP services, self-signed certificates, Python SimpleHTTP payload hosting, a Windows host identified as `TEDDY2012`, and domain registration details that appeared to expose operator identity. Separate reporting also described a related **Gh0stRAT/Farfli** "WisemanSupport" campaign using TCP/6658 and hardcoded infrastructure, reinforcing the continued use of Chinese-nexus RAT tooling and overlapping tradecraft in active intrusion operations.
Jun 29, 2026
A malware campaign is using fake Microsoft Teams download pages promoted on **X** to lure corporate users into installing trojanized ZIP archives that deploy **ValleyRAT**. Researchers said the infection chain relies on an **NSIS** installer and **DLL sideloading** through Tencent’s legitimate `GameBox.exe`, then uses PowerShell to add Windows Defender exclusions, hide files, and establish persistence through unauthorized service creation and registry artifacts including `_CCGDAT`. Once executed, the loader decrypts staged payloads from `user.dat` in memory using **AES** and **XOR**, with additional evasion through API hashing and reflective loading. The final ValleyRAT payload captures keystrokes, clipboard contents, and active-window activity before exfiltrating data to command-and-control infrastructure at `103.215.77.17`; researchers said the campaign shows Chinese-language artifacts and behavioral overlaps that likely tie it to the **SilverFox APT** cluster.
Jun 30, 2026
The Chinese threat actor known as **Silver Fox** has launched a targeted phishing campaign against Indian organizations, using income tax-themed emails to deliver the modular remote access trojan **ValleyRAT**. Attackers impersonate the Indian Income Tax Department, sending emails with decoy PDF attachments that, when opened, direct victims to a malicious website hosting a ZIP archive. This archive contains a disguised installer that leverages DLL hijacking, specifically abusing a legitimate executable (`thunder.exe`) and a malicious DLL (`libexpat.dll`), to establish persistent access and evade detection. The campaign demonstrates a sophisticated multi-stage infection chain, with the initial payload acting as a loader for subsequent malware modules designed to maintain deep access to compromised systems. Researchers from CloudSEK have attributed this campaign to Silver Fox, correcting previous misattributions to other threat groups. The group, also known as SwimSnake and Void Arachne, has expanded its targeting beyond Chinese-speaking entities to include Indian public, financial, medical, and technology sectors. The use of socially engineered tax documents and trusted file formats highlights the attackers' ability to bypass traditional security controls, while the complex kill chain and modular malware architecture underscore the evolving threat posed by Silver Fox to Indian organizations.
Jun 29, 2026