Chinese-Language Malware Operations Exposed Through GoLoader, ValleyRAT, and FUD Crypt

Researchers uncovered multiple malware operations using scalable builder and crypting infrastructure to deliver remote-access trojans and evade detection. Breakglass Intelligence found two unauthenticated GoLoader builder panels that had produced 468,349 polymorphic samples across 71 active tasks, while leaking Alibaba Cloud OSS credentials tied to a public bucket containing LNK droppers, polymorphic VBS scripts, steganographic PNG carriers, .NET loaders, and RAT payloads. The reconstructed infection chain ended with njRAT, and reversing its custom AES-256-ECB configuration revealed the C2 laohe1[.]myvnc[.]com:5000, overlapping with infrastructure previously associated with XWorm. The campaign was assessed with moderate confidence as operated by a Chinese-speaking actor using Simplified Chinese cryptocurrency lures.

A separate Breakglass report linked ValleyRAT samples targeting Chinese-speaking users to a campaign that blended long-lived Hong Kong infrastructure with a likely compromised UK academic relay. One sample connected to 103.215.77[.]17:4488, a Hong Kong-hosted server linked to dozens of related malware submissions, while another Rust loader masquerading as Microsoft OneDrive Sync Engine decrypted and loaded a ValleyRAT core DLL after sandbox checks; its stage-two C2 used a govroam.cf.ac[.]uk hostname resolving into Cardiff University space, suggesting temporary relay use through a compromised GovRoam-connected endpoint. In parallel, researchers analyzing the FUD Crypt malware-as-a-service platform found it packaged Windows malware with persistence, C2, and evasion features, tracked 200 registered users and 334 confirmed builds, and documented abuse of Microsoft Azure Trusted Signing to produce Microsoft-rooted Authenticode signatures for malicious binaries.