The threat actor known as Silver Fox has been linked to a campaign distributing the ValleyRAT backdoor disguised as a legitimate, digitally signed Chinese adware application.
The malware is delivered through a modified version of QN Wallpaper, a genuine Chinese desktop wallpaper application that normally operates as adware by bundling partner software and displaying advertisements.
Once installed, ValleyRAT — also known as Winos 4.0 — gives attackers extensive control over compromised Windows systems. The campaign uses trusted software and Windows processes to make the infection less suspicious, particularly on systems where users have added the application to antivirus or security-tool exclusion lists.
ValleyRAT Uses Trusted Software to Evade Detection
The attack relies on a technique known as DLL sideloading.
The malicious installer deploys a modified copy of QN Wallpaper along with its legitimate, digitally signed executable, QnWallpaper.exe. When the executable starts, it loads a malicious libcef.dll placed in the same directory.
Because the malicious DLL is loaded by a legitimately signed application, ValleyRAT can execute within a trusted process and potentially bypass security controls that place excessive trust in signed software.
The installer also attempts to weaken Windows security before launching the adware component. It modifies the Windows Registry to disable Microsoft Defender’s DisableAntiSpyware setting and establishes persistence through Windows autorun mechanisms.
If the logged-in user does not have administrator privileges, the malware can relaunch itself using the Windows runas mechanism in an attempt to obtain elevated privileges.
Another particularly disruptive capability allows ValleyRAT to mark its own process as critical. If an attacker or security tool attempts to terminate the process, Windows can trigger a Blue Screen of Death (BSOD).
ValleyRAT Capabilities
ValleyRAT is a full-featured remote access backdoor capable of giving attackers control over an infected computer.
Its capabilities include:
- Capturing keystrokes
- Collecting clipboard contents
- Taking screenshots
- Downloading and executing additional malicious modules
- Establishing persistence on compromised systems
- Communicating with attacker-controlled command-and-control servers
- Attempting to obtain elevated privileges
- Protecting its process from termination
The combination of these capabilities allows attackers to monitor victims, steal sensitive information and expand the compromise with additional malware.
Indicators of Compromise
Security researchers identified the following indicators associated with the campaign.
MD5 Hashes
c24e99f9437feacaa63766a3cde3fe3d— submitted installer07ddbbe2c71c45577a7a4fbcdba0df91— maliciouslibcef.dll8a626d844943da3456b044f38deae3a2
Command-and-Control Servers
103.45.66.18— ports441,442and443192.253.225.173— ports6666and8888
Domains
qnwallpaper[.]keansoft[.]cn— download site associated with the abused adwaremeeting[.]tencent[.]com— legitimate Tencent page used as a decoy
Host Artifacts
- Registry value:
DisableAntiSpyware - Installation directory:
C:\Program Files\QNWallpaper\5.4.0.1662\
Security teams can use these indicators to search endpoints, network logs and threat-hunting platforms for signs of compromise.
DLL Sideloading Remains a Key Silver Fox Technique
Abusing legitimate applications through DLL sideloading is an established technique associated with Silver Fox.
In another campaign targeting a Japanese manufacturer, researchers documented the group’s use of legitimate applications to load malicious DLLs. The libcef.dll filename has also appeared in an earlier ValleyRAT loader observed in 2025.
Silver Fox has previously been associated with campaigns targeting organizations in countries including India and Russia, demonstrating the group’s continued use of malware loaders, trusted applications and social-engineering techniques.
Why This Campaign Matters
The attack highlights the risks of treating digitally signed software as automatically trustworthy.
A valid software signature can confirm that an executable was signed by a particular publisher, but it does not necessarily guarantee that every component loaded by that executable is safe. In this case, attackers abuse a legitimate signed application to load a malicious DLL.
The campaign also demonstrates why users and organizations should be cautious when adding questionable software to antivirus exclusions. Security exclusions can prevent security products from inspecting files and processes, potentially giving malware an easier path to execute undetected.
Organizations should maintain clear policies governing third-party software installed on corporate systems and educate employees about the risks of downloading unfamiliar applications.
How to Stay Protected
Users and organizations can reduce the risk of ValleyRAT infections by following several basic security practices:
- Avoid downloading software from unofficial or questionable sources.
- Do not add unfamiliar applications to antivirus exclusion lists simply because they generate security warnings.
- Keep Windows and security software fully updated.
- Restrict the installation of unauthorized third-party applications on company devices.
- Monitor unusual Registry changes, autorun entries and unexpected privilege-elevation attempts.
- Hunt for known ValleyRAT indicators across endpoints and network infrastructure.
- Investigate legitimate signed applications that unexpectedly load DLLs from unusual directories.
The ValleyRAT campaign is a reminder that attackers do not always need to disguise malware as obviously malicious software. Abusing trusted applications can provide an effective way to blend malicious activity into otherwise legitimate processes, making endpoint monitoring and careful software-management policies increasingly important.
