ValleyRATMalware
- winos
Last reported 4 days ago, by The Hacker News10 reports
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1036Masquerading
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
- T1213.005Messaging Applications
“Primary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.”
- T1218.002Control Panel
“A notable example involved the use of javacpl.Exe (Java Control Panel), where deploy.Dll was loaded as a malicious DLL and then connected to a C2 server to download ValleyRAT.”
- T1684Social Engineering
“The findings indicate how ClickFix is evolving beyond a social engineering technique into a highly effective entry point for malware.”
- T1014Rootkit
“…e the leak of ValleyRAT builder in 2023, the intrusion set continued to use it, exploiting zero-day driver plugin and using kernel-mode rootkit likely for intelligence collection.”
- T1027Obfuscated Files or Information
“The key TTPs identified are T1608.006, T1036, T1204.002, T1620, T1055, and T1027.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware“…ox (aka TA4922), a China-aligned threat actor known for repeatedly using tax-related pretexts to distribute remote access trojans like ValleyRAT (aka Winos 4.0), DcRAT, and potentially Venom RAT via DLL sideloading techniques.”
-
SilverFox: Tracking the Distribution of a Domestic Variant of a Malicious Installation File Posing as KakaoTalk“… use of javacpl.Exe (Java Control Panel), where deploy.Dll was loaded as a malicious DLL and then connected to a C2 server to download ValleyRAT.”
-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“More ValleyRAT: Looks like SilverFox is back to its old self despite the recent arrests in China of some of its members.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“ValleyRAT: Kaspersky noted a new tactic being used to deliver SilverFox's ValleyRAT, hiding the malware together with adware and PUPs.”
-
ValleyRAT masquerading as adware“ValleyRAT masquerading as adware”
-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“…ed for sale on the Exploit forum in autumn 2025 and now underpins dozens of campaigns delivering AsyncRAT, Agent Tesla, Remcos, XWorm, ValleyRAT and Snake Keylogger.”
-
Silver Fox: The only Tax Audit Where Fine Print Installs Malware“Silver Fox's attack campaigns evolved between 2025 and 2026, transitioning from the ValleyRAT malware delivered via malicious PDF attachments to abusing a legitimate but misconfigured Chinese Remote Monitoring and Management (RMM) tool, and most recently, deploying a custom Pytho…”
-
A cunning predator: How Silver Fox preys on Japanese firms this tax season“Opening the malicious files drops ValleyRAT, a remote access trojan that Silver Fox has used across multiple campaigns.”
-
JSAC2026 -Day 2-“The malware used in the campaign included ValleyRAT and VShell.”
-
PureRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading“We initially attributed the findings in this report to ValleyRAT based on the preliminary indicators observed during our investigation.”
Indicators in its reports
named in the reports above- c24e99f9437feacaa63766a3cde3fe3din 1 report
- hxxps://meeting.tencent[.]com/download/in 1 report
- hxxps://qnwallpaper.keansoft[.]cn/in 1 report
- qnwallpaper.keansoft[.]cnin 1 report
- 7ad1e3ef4e6d9d636c9e7e967733850ein 1 report
- 96b4c1d0683dce22bd3223e1e40689c1in 1 report
- 9b86d3ab6cef15c633933fbbeab39c0ain 1 report
- edfdc30cbd85879776b8f735ea7de1f1in 1 report
- 07ddbbe2c71c45577a7a4fbcdba0df91in 1 report
- 48826d5ca845979d2e6ebd66dc1aae90in 1 report
- 6c158c0f8e029342192d4f0d72e102b7in 1 report
- 9a71d6a41cd258b9e89cdc5fc224de73in 1 report
- 8a626d844943da3456b044f38deae3a2in 1 report
- 103.45.66[.]18in 1 report
- 192.253.225[.]173in 1 report
- e2b75baeb7ed21fb…167bd24ba6dcin 1 report
- hxxps://6-1321729461.cos.ap-guangzhou.myqcloud[.]com/lnstaller.msiin 1 report
- hxxps://00-1321729461.cos.ap-guangzhou.myqcloud[.]com/2024.7zin 1 report
- 9010.360sdgg[.]comin 1 report
- googlevip[.]icuin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.