The threat actor known as **Silver Fox** has been observed distributing the **ValleyRAT** backdoor disguised as a signed Chinese adware application. This technique allows the malware to run under a trusted process, thereby slipping past users who add such software to their antivirus exclusions. Russian cybersecurity vendor **Kaspersky** reported that the attackers built this disguise around **QN Wallpaper**, a genuine Chinese desktop-wallpaper tool. In its unmodified form, **QN Wallpaper** functions as adware, bundling partner applications and displaying ad banners. Once installed, **ValleyRAT** (also tracked as Winos 4.0) grants the operator full control of the compromised machine. **Kaspersky** noted that the attack's geographical focus and payload strongly suggest **Silver Fox** is the likely group behind it. The firm urged users to avoid software of questionable reputation and, critically, to keep it off security-tool exclusion lists. "This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. **ValleyRAT** is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules," **Kaspersky** stated in its analysis.  ### Technical Evasion: DLL Sideloading and Privilege Escalation The disguise relies heavily on DLL sideloading. The installer unpacks a modified copy of **QN Wallpaper** and executes its signed executable, `QnWallpaper.exe`. This legitimate process then loads a malicious `libcef.dll` that has been strategically placed in the same directory. By executing within a legitimately signed process, the backdoor operates without triggering security controls that trust the signature. Before the adware component even starts, the installer takes steps to disable **Windows Defender** via the `DisableAntiSpyware` registry key and adds the program to the system's autorun entries. If the logged-in user lacks administrator rights, the malware relaunches itself using `runas` to acquire them. **ValleyRAT** also possesses the capability to flag its own process as critical, meaning any attempt to terminate it will trigger a blue screen of death (BSOD).  ### Indicators of Compromise (IoCs) **Kaspersky** has shared the following Indicators of Compromise: * **Hashes (MD5):** * `c24e99f9437feacaa63766a3cde3fe3d` (submitted installer) * `07ddbbe2c71c45577a7a4fbcdba0df91` (malicious `libcef.dll`) * `8a626d844943da3456b044f38deae3a2` * **Command-and-control servers:** * `103.45.66.18` on ports `441`, `442`, and `443` * `192.253.225.173` on ports `6666` and `8888` * **Domains in the chain:** * `qnwallpaper[.]keansoft[.]cn` (abused adware's download site) * `meeting[.]tencent[.]com` (legitimate page opened as a decoy) * **Host artifacts:** * The `DisableAntiSpyware` registry value * Install directory `C:\Program Files\QNWallpaper\5.4.0.1662\` ### Silver Fox's Evolving Tactics DLL sideloading through signed, legitimate software is a well-established tactic within **Silver Fox**'s toolkit. Approximately five weeks prior, **Cato Networks** documented the group's "newly observed abuse of legitimate applications for DLL sideloading" in a campaign targeting a Japanese manufacturer. The same `libcef.dll` filename was also identified in a **ValleyRAT** loader from a 2025 report. **Kaspersky** itself previously tracked **Silver Fox** in an earlier tax-themed campaign that targeted organizations in India and Russia. ### Scope of the Threat and Recommendations **Kaspersky**'s current account is based on a single installer submitted by a customer, and the report does not provide a victim count specifically for this adware-based infection route. However, throughout 2026, the vendor recorded over 100,000 detections of **ValleyRAT** and associated malware, affecting more than 1,500 unique users, primarily in China and India. This figure encompasses all **ValleyRAT** activity observed during that year. **Kaspersky** strongly advises organizations to establish clear policies regarding third-party software on work devices and to ensure staff are fully aware of the associated threats. "For individual users, we recommend avoiding the installation of software with a questionable reputation, and, even more importantly, never adding such software to your security solutions' exclusion lists," the company reiterated.