ValleyRat Campaign repackages installers for popular tools

Du'aine Davis

Observed in the wild

• Since August 2025, China-aligned APT Silver Fox has targeted Windows systems through repackaged installers for popular apps (Telegram, Chrome, WinSCP, Teams). Victims unknowingly install a trojanised executable that stages files, disables protections, and ultimately deploys the ValleyRat beacon for persistent access.
• Attackers spread fake software installers through phishing emails and malicious ads. Once installed, the malware disables Microsoft Defender by adding exclusions for the C:\ drive, sneaks in extra DLL files, bypasses User Account Control, and uses a vulnerable driver to shut down security tools. It stays active by creating scheduled tasks that run hidden scripts, while special drivers reduce the effectiveness of security monitoring.
• Watch for unusual folders like C:\ProgramData\WindowsData\ or %PUBLIC%\Documents\WindowsData\, Defender exclusion changes (Event ID 5007), and scheduled tasks linked to Users\Public. Strengthen protection by blocking unsigned installers in Microsoft Defender, applying AppLocker rules, and searching for suspicious commands (e.g., password-protected 7-Zip extractions).

Thor vs. Silver Fox – Uncovering and Defeating a Sophisticated ValleyRat Campaign - Nextron Systems