Do Son 
At a Glance
- Actor or group: Silver Fox
- Activity type: Backdoor delivery, spyware, DLL sideloading
- Targets or victims: Users in China and India
- Scale: Over 100,000 detections affecting more than 1,500 unique users
- Jurisdiction or law-enforcement status: Suspected China-nexus threat actor
- Source: Kaspersky Labs Threat Research
TL;DR
Kaspersky researchers analyzed a new campaign delivering the ValleyRAT backdoor through signed adware packages. The attackers disguised malicious files inside a Chinese desktop wallpaper utility to evade detection. System administrators should monitor endpoints closely for abnormal process injection and unauthorized DLL loading.
What Happened
Security analysts at Kaspersky identified a deceptive installer delivering the ValleyRAT backdoor under the guise of legitimate software. The installer used varied filenames to trick users by masquerading as Google Chrome, DingTalk, or Tencent Meeting. Regardless of the filename, the installer deployed a modified wallpaper utility called QN Wallpaper.
The original software functioned as standard adware, but attackers adapted it for malicious execution. As the report explains, “In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.”
The installer unpacks several components into the program directory. It then uses the DisableAntiSpyware registry value to disable Windows Defender. Next, the installer launches the main wallpaper executable to execute a malicious DLL called libcef.dll via DLL sideloading.
Privilege Escalation and Defense Evasion
The malicious library checks if the current user belongs to the local Administrators group. If the user lacks admin rights, the program repeatedly prompts for elevation using the Windows runas utility. Once elevated, it extracts and decrypts the backdoor from the PeLoader file or internal DLL resources.
The backdoor includes several layers of process defense. It allocates memory inside svchost.exe to inject a watchdog thread that restarts the backdoor if closed. Additionally, operators can configure the malware to mark its own process as critical. This configuration causes Windows to trigger a Blue Screen of Death if anyone terminates the process.
Spyware and Remote Access Capabilities
ValleyRAT functions as a dedicated spyware and remote control tool. The implant captures keystrokes using DirectInput8 functions and steals clipboard contents. It also searches for security tools such as Wireshark, Process Explorer, and traffic monitors.
When connected to its command server, the backdoor can execute shell commands, take desktop screenshots, and wipe Windows event logs. Furthermore, a detailed ValleyRAT backdoor analysis reveals that the malware uses process hollowing to run secondary payloads inside svchost.exe.
Who Is Behind It
Kaspersky attributes this malicious activity to the threat actor group known as Silver Fox. Researchers hold moderate confidence in this attribution based on recurring infrastructure and specific code patterns. Silver Fox has a long history of deploying ValleyRAT across multiple regions.
The attackers selected signed adware packages specifically to evade standard security scans. As the analysts noted, “The attackers may have chosen this distribution method because the adware was signed by the developer.” Users frequently add signed utilities to local antivirus exclusion lists, allowing the malware to operate without interruption.
Impact or Scale
Kaspersky telemetry recorded extensive exploitation activity throughout 2026. The vendor observed the backdoor and its related loaders more than 100,000 times during this timeframe. These infection attempts impacted over 1,500 unique users, mainly across China and India.
The threat group operates with dual motives of financial gain and cyberespionage. By harvesting credentials and sensitive clipboard records, the attackers compromise corporate and personal accounts. Furthermore, the backdoor allows operators to download additional payloads, expanding the risk of follow-on attacks.
What Comes Next and How Readers Can Stay Protected
Threat groups will continue using signed software and third-party affiliate networks to distribute malware. Security teams cannot rely purely on code-signing certificates to establish trust. Defenders must take immediate steps to secure their endpoints against DLL sideloading and process tampering.
Key Defensive Actions
Organizations should enforce strict application allowlisting to prevent unauthorized software installation. Security teams must prohibit standard users from disabling antivirus tools or creating broad exclusion folders.
Additionally, administrators should monitor registry modifications, abnormal svchost.exe injection events, and unexpected outbound network traffic. Prompt endpoint inspection and proper network segmentation remain crucial to neutralizing these stealthy intrusions.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
