Scenario A: Technical Threat, Vulnerability, or Exploit
Silver Fox is back with a new ValleyRAT campaign, this time weaponizing trust by hiding the backdoor inside a signed Chinese adware application (QN Wallpaper). The social engineering is particularly nasty: users are tricked into adding the legitimate-looking adware to their antivirus exclusions, which then allows the signed binary to drop and execute the ValleyRAT payload without triggering alerts.
Technical Breakdown – Initial Access: Users download QN Wallpaper (a legitimate desktop tool) from third-party sites. The installer is signed, bypassing initial AV checks. – Execution Flow: The signed adware runs, then loads a malicious DLL that decrypts and injects ValleyRAT into a trusted process (e.g., explorer.exe or svchost.exe). – Persistence: Achieved via scheduled tasks or registry run keys, often masquerading as legitimate software updates. – C2 Communication: ValleyRAT uses HTTP/HTTPS with encrypted payloads. Known C2 domains are often registered on Chinese TLDs (.cn, .com.cn) and use dynamic DNS. – Capabilities: Full RAT functionality—keylogging, screen capture, file exfiltration, and remote shell access. Targets primarily Chinese-speaking users, but infrastructure may overlap with other campaigns.
Defense – Policy: Block execution of signed binaries from untrusted publishers, even if they appear legitimate. Use application whitelisting (e.g., AppLocker, WDAC). – Detection: Monitor for processes spawning from signed adware that then inject code into system processes. Look for anomalous network connections from svchost.exe or explorer.exe to unknown IPs. – User Education: Warn users against adding any software to AV exclusions, especially "free" wallpaper or utility tools.
Source: https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html
Source: r/SecOpsDaily · by /u/falconupkid