ValleyRAT Backdoor Disguised in Signed Adware Bypasses Security
Silver Fox group spreads malware through antivirus-exempt wallpaper apps in China and India.
1Infiltration via Fake Wallpaper App
The Silver Fox group is distributing the ValleyRAT backdoor by modifying QN Wallpaper, a legitimate Chinese desktop application, with fake signatures. According to Kaspersky, this seemingly harmless adware contains malicious code that users willingly add to antivirus exclusions. Using DLL sideloading technique, the malware loads libcef.dll file while running under a signed process to bypass security controls.
2Full System Control Capability
ValleyRAT (also tracked as Winos 4.0) provides complete control over infected systems. Kaspersky's analysis reveals the backdoor records keystrokes, clipboard data, captures screenshots, and delivers additional malicious modules. The malware also marks itself as a 'critical process', causing blue screen errors during termination attempts. It makes registry changes to disable Windows Defender and gains admin privileges via runas command when needed.
3Silver Fox's Signature Technique
Kaspersky attributes the attack to Silver Fox based on geographical patterns and payload analysis. The group previously used the same libcef.dll file in an attack against a Japanese manufacturer. Similarities with a 2025 ValleyRAT loader demonstrate their expertise in abusing signed software. Earlier tax-themed campaigns in India and Russia have also been linked to this group.
4Exploiting User Security Habits
The attack's success relies on users' tendency to add questionable software to antivirus exclusions. While Kaspersky analyzed a single sample where ad features remained inactive, the infection chain disables security measures during installation. When users lack admin rights, the malware relaunches itself with elevated privileges using runas command.
5100,000+ Cases in 2026
Kaspersky's 2026 data shows ValleyRAT and related malware were detected on over 150,000 computers, primarily in China and India. The report doesn't specify victim counts for this particular campaign, leaving the prevalence of adware distribution unclear. The company warns organizations to tighten third-party software policies on work devices.
6Growing Industry Threat
DLL sideloading has become increasingly popular among cybercriminals. Kaspersky notes that abuse of signed software plays a critical role in bypassing traditional security solutions. Silver Fox's repeated use of this method across different regions and sectors suggests similar attacks will escalate.
7Corporate and Individual Precautions
Kaspersky recommends organizations establish clear third-party software policies and educate staff about threats. For individual users, the critical warning is to never add suspicious software to security solution exclusions. Testing software from adware distribution networks in sandbox environments is strongly advised.
8Security in the AI Era
As AI accelerates cyber threats, organizations must reevaluate defense strategies. Kaspersky experts emphasize the need for proactive approaches to quickly identify and prioritize exploit risks. The ValleyRAT case starkly demonstrates how seemingly trustworthy software can transform into critical threats.
Original article: The Hacker News — ValleyRAT: İmzalı Adware ile Gizlenen Tehlikeli Backdoor