🛠️ RMM Abuse: Transitioned from deploying #ValleyRAT via malicious PDFs to abusing Chinese #RMM tools.
🐍 Custom Payloads: Recently observed dropping a custom Python-based stealer embedded in a Python installer.

Silver Fox: The Only Tax Audit Where the Fine Print Installs Malware Since early 2025, China-based intrusion set Silver Fox has combined APT-style operations (using modular backdoors like ValleyRAT and HoldingHands) with opportunistic financially motivated campaigns across South Asia. The group evolved delivery from malicious PDFs and DLL side-loading to abusing a misconfigured Chinese RMM tool and a compiled Python stealer that exfiltrates data to xqwmwru[.]top. #SilverFox #ValleyRAT

Since 2025, Silver Fox blends APT-like espionage with financial attacks, using modular backdoors like ValleyRAT and exploiting a misconfigured Chinese RMM tool to install malware and steal data. #SilverFox #China #ValleyRAT

Cybercriminals are using a fake Huorong antivirus site to distribute ValleyRAT malware. Stay vigilant and verify URLs before downloading software. #CyberSecurity #MalwareAlert #ValleyRAT Link: thedailytechfeed.com/cybercrimina...

Fake LINE Messenger Installer Spreads ValleyRAT Malware The Silver Fox APT group is distributing the ValleyRAT remote access trojan through a trojanized installer for the LINE messaging app to steal credentials from Chinese-speaking users.

A fake LINE messenger installer is being used to spread ValleyRAT malware. The campaign, linked to the Silver Fox APT, targets Chinese-speaking users for credential theft. 🦊 #Malware #ValleyRAT #CyberSecurity

Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware gathering to financial gain read more about Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware

Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware reconbee.com/silver-fox-t...

#silverfox #taxthemedemails #emails #tax #ValleyRATmalware #ValleyRAT #malware #cyberattack #CybersecurityNews

ANY.RUN Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Some fresh (2025-12-18) #silverfox #valleyrat

app.any.run/tasks/5f8778b4-7a5a-42fc...

ValleyRAT malware employs stealthy driver installations to bypass Windows 11 protections, posing a significant threat to global organizations. #CyberSecurity #Malware #Windows11 #ValleyRAT Link: thedailytechfeed.com/valleyrat-ma...

Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits - Check Point Research Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the ...

'Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits'

research.checkpoint.com/2025/crackin...

#CyberSecurity #ValleyRAT #Trojan #Rootkit #ReverseEngineering

ValleyRAT: Builder Secrets & Kernel Rootkits

~Checkpoint~
Analysis of ValleyRAT reveals a kernel rootkit bypassing Windows 11, with a leaked builder causing a surge in its use.
-
IOCs: sun-rat. com
-
#Rootkit #ThreatIntel #ValleyRAT

구직자 를 대상 으로 Foxit PDF 리더 로 위장한 악성코드-document.bat 오늘은 구직자를 대상으로 Foxit PDF 리더 로 위장한 악성코드인 ValleyRAT 에 대해서 알아보겠습니다.일단 제가 악성코드를 구할 수 있는 한도에서 분석하게 되고 완전체가 아닌 점을 알아주세요. 취업 기회를 찾는 구직자는 이메일을 통해 전파된 ValleyRAT 캠페인이 Foxit PDF Reader를 이용해 은폐하고 DLL 사이드 로딩을 이용해 최...

구직자 를 대상 으로 Foxit PDF 리더 로 위장한 악성코드-document.bat
wezard4u.tistory.com/429667
#ValleyRAT #악성코드

Original post on infosec.exchange

RE: infosec.exchange/@VirusBulletin/115660902...

How is this #ValleyRAT? It looks, swims and quacks like #PureRAT.
Here are some typical PureRAT indicators:
:windows: .NET malware
🔑 TLS version is 1.0
🫆 JA3 = fc54e0d16d9764783542f0146a98b300 or 07af4aa9e4d215a5ee63f9a0a277fbe3
🫆 […]

Campagna ValleyRAT colpisce i cercatori di lavoro sfruttando falsi documenti Foxit e side-loading DLL. Analisi completa di tecniche, rischi e impatti.

#RAT #sideloading #TrendMicro #ValleyRAT
www.matricedigitale.it/2025/12/04/v...

Cybercriminals are exploiting trusted apps like Telegram and Chrome to deploy ValleyRAT malware. Stay vigilant and ensure software integrity. #CyberSecurity #MalwareAlert #ValleyRAT Link: thedailytechfeed.com/silver-fox-a...

Cybercriminals are exploiting trusted apps like Telegram and Chrome to deploy ValleyRAT malware. Stay vigilant and ensure software integrity. #CyberSecurity #MalwareAlert #ValleyRAT Link: thedailytechfeed.com/silver-fox-a...

ValleyRAT Targets Job Seekers via Foxit Reader

~Trendmicro~
A campaign targets job seekers with email lures, using a weaponized Foxit PDF Reader for DLL side-loading to deploy ValleyRAT.
-
IOCs: 196. 251. 86. 145, 51. 79. 214. 125, 154. 90. 58. 164
-
#DLLSideloading #ThreatIntel #ValleyRAT

Operation Silk Lure targets Chinese fintech firms using Windows Task Scheduler to deploy ValleyRAT malware. Stay vigilant against spear-phishing attacks. #CyberSecurity #Malware #ValleyRAT #Fintech Link: thedailytechfeed.com/operation-si...

Gh0stKCP Protocol Gh0stKCP is a command-and-control (C2) transport protocol based on KCP. It has been used by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyR...

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT.
netresec.com?b=259a5af

@netresec

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT.
https://netresec.com/?b=259a5af

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP Protocol Gh0stKCP is a command-and-control (C2) transport protocol based on KCP. It has been used by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to take a closer look at the protocol, so I downloade[...]

Gh0stKCP Protocol Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Chinese Silver Fox Group Exploits Trusted Windows Drivers to Deploy ValleyRAT Malware

Silver Fox used WatchDog Antimalware driver (amsdk.sys v1.0.600) to bypass defenses and install ValleyRAT. Zemana Anti‑Malware driver (ZAM.exe) adds Windows 7‑11 coverage. getnews.me/chinese-silver-fox-group... #silverfox #valleyrat

Silver Fox exploits Microsoft-signed WatchDog driver to deploy ValleyRAT malware, bypassing security measures. #CyberSecurity #Malware #SilverFox #ValleyRAT #WatchDogDriver Link: thedailytechfeed.com/silver-fox-e...