The notorious threat actor known as Silver Fox has recently been linked to the distribution of a sophisticated backdoor known as ValleyRAT. This malware is cleverly disguised as a legitimate Chinese adware application, specifically the QN Wallpaper tool, which is known for bundling partner applications and displaying advertisements. By leveraging this disguise, the attackers are able to operate under the radar, particularly targeting users who mistakenly add such software to their antivirus exclusions.
According to Russian cybersecurity firm Kaspersky, once ValleyRAT is installed, it grants the operator complete control over the compromised machine. The analysis indicates that the geographical footprint and payload characteristics strongly suggest Silver Fox’s involvement in this malicious campaign. Kaspersky has advised users to exercise caution with software of dubious reputation and to refrain from including such applications in security-tool exclusions.
Technical Insights into ValleyRAT
Kaspersky’s report highlights the technical intricacies of how the disguise operates, primarily through a method known as DLL sideloading. The installer unpacks a modified version of QN Wallpaper and executes its signed executable, QnWallpaper.exe. This process subsequently loads a malicious libcef.dll file located in the same directory. By executing the backdoor within a legitimately signed process, the malware can bypass security controls that would typically flag it as suspicious.
Before the adware component activates, the installer disables Windows Defender using the DisableAntiSpyware registry key and ensures that the program is added to the system’s autorun entries. In instances where the logged-in user does not possess administrator rights, the malware employs the runas command to relaunch itself with elevated privileges.
ValleyRAT is equipped with the capability to mark its own process as critical, which means any attempt to terminate it can result in a blue screen of death, further complicating efforts to remove the malware.
Kaspersky has provided several indicators of compromise (IoCs) to assist in identifying potential infections:
- Hashes (MD5):
c24e99f9437feacaa63766a3cde3fe3d(installer),07ddbbe2c71c45577a7a4fbcdba0df91(maliciouslibcef.dll),8a626d844943da3456b044f38deae3a2 - Command-and-control servers: 103.45.66.18 on ports 441, 442, and 443; 192.253.225.173 on ports 6666 and 8888
- Domains in the chain: qnwallpaper[.]keansoft[.]cn (the adware’s download site) and meeting[.]tencent[.]com (a legitimate page used as a decoy)
- Host artifacts: the
DisableAntiSpywareregistry value and the installation directoryC:Program FilesQNWallpaper5.4.0.1662
DLL sideloading through signed, legitimate software has become a hallmark of Silver Fox’s tactics. Just weeks prior, Cato Networks documented similar behavior in a campaign targeting a Japanese manufacturer, where the same libcef.dll filename was utilized in a ValleyRAT loader from 2025.
Kaspersky has previously tracked Silver Fox’s activities in a tax-themed campaign aimed at organizations in India and Russia. Their current findings stem from a single installer submitted by a customer, and while the adware features remain inactive during the infection chain, the report does not specify a victim count associated with this particular adware route.
Throughout 2026, Kaspersky recorded over 100,000 detections of ValleyRAT and related malware, impacting more than 1,500 unique users, predominantly in China and India. This figure encompasses all ValleyRAT activity throughout the year, not just the current campaign.
In light of these developments, Kaspersky has urged organizations to establish clear policies regarding third-party software on work devices and to enhance staff awareness of potential threats. For individual users, the recommendation is straightforward: avoid installing software with questionable reputations and, crucially, never add such software to security solutions’ exclusion lists.
