Full research report

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Silver Fox has operationalised the intersection of two user behaviours—installing low-reputation adware and adding it to antivirus exclusions—to create a reliable, low-noise delivery path for ValleyRAT that sidesteps endpoint controls without requiring any software vulnerability. The technique itself is not new: Nextron Systems documented Silver Fox DLL sideloading via signed executables in November 2025, and Cato Networks confirmed the group was still abusing legitimate applications in July 2026 against a Japanese manufacturer, though with a different DLL. What distinguishes this campaign is the deliberate selection of adware as the host application, exploiting the institutional tolerance users and IT teams extend to adware that was already present and excluded before compromise occurred. ValleyRAT's ability to mark its own process as critical—turning any termination attempt into a system crash—significantly complicates live incident response and means that safe-mode or offline remediation is the realistic path once the implant is established. The Kaspersky report rests on a single submitted sample, so while the technical evidence is solid, the true geographic and organisational spread of this specific installer remains an open question.

What happened

Silver Fox, a China-nexus threat actor active since at least 2022, was observed distributing the ValleyRAT backdoor hidden inside a modified installer of QN Wallpaper, a signed Chinese adware application. Kaspersky identified the campaign from a single customer-submitted sample and published its analysis on 31 August 2026. The campaign exploits user behaviour: adware is frequently tolerated and added to antivirus exclusions, granting the malicious DLL an unmonitored execution environment inside a trusted signed process. Over 100,000 ValleyRAT detections affecting more than 1,500 unique users were recorded across 2026 in China and India, though that figure encompasses the broader ValleyRAT campaign rather than this installer specifically.

Affected scope

Windows users who install QN Wallpaper or similarly signed adware, particularly those who add such software to antivirus exclusions; geographic focus is China and India; no specific sector targeting confirmed in this campaign, contrasting with Silver Fox's prior focus on healthcare, industrial manufacturing, and financial-themed lures

Technical assessment

The installer deploys a modified QN Wallpaper package and plants a malicious libcef.dll alongside the legitimately signed QnWallpaper.exe. Windows DLL search-order behaviour loads the local library before any system-path equivalent, executing ValleyRAT within the signed process's security context and bypassing signature-based trust controls. Before launching the application, the installer disables Windows Defender via the DisableAntiSpyware registry key and establishes autorun persistence; when the active session lacks administrator rights, the malware re-invokes itself via runas to elevate. ValleyRAT subsequently injects into svchost.exe for persistence, marks its own process as critical—forcing a Blue Screen of Death on termination attempts—and establishes command-and-control communications over non-standard ports, complicating incident response once the implant is resident.

Recommended defensive actions

  1. Block outbound connections to 103.45.66.18 (ports 441, 442, 443) and 192.253.225.173 (ports 6666, 8888) at perimeter firewall and endpoint security controls
  2. Hunt across endpoint telemetry for the three known MD5 hashes: c24e99f9437feacaa63766a3cde3fe3d (installer), 07ddbbe2c71c45577a7a4fbcdba0df91 (malicious libcef.dll), and 8a626d844943da3456b044f38deae3a2
  3. Audit all antivirus and EDR exclusion lists and remove entries for adware, wallpaper utilities, or any software from unverified or low-reputation publishers
  4. Hunt for the DisableAntiSpyware registry value and the install directory C:\Program Files\QNWallpaper\5.4.0.1662\ as indicators of compromise
  5. Enforce application allowlisting or software installation controls to prevent unvetted installers from executing, particularly in environments where users may install consumer-grade utilities

Uncertainties and evidence gaps

  • The Kaspersky report rests on a single customer-submitted sample; independent evidence of wider campaign scale is not available, meaning victim count and distribution method breadth are unverified
  • The 100,000-detection and 1,500-user figures cover ValleyRAT and associated malware broadly across 2026, not specifically this QN Wallpaper installer
  • The claim that libcef.dll featured in a 2025 ValleyRAT loader is asserted in secondary reporting but no primary source was found to verify the specific 2025 sample lineage; Nextron Systems' November 2025 report used a different DLL
  • Silver Fox attribution rests on geography and payload characteristics identified by Kaspersky; no government body or independent threat-intelligence firm has formally corroborated the attribution for this specific campaign

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUser-initiated installation of what appears to be a legitimate signed adware application, compounded when the user has previously added the software to antivirus exclusions
ComponentWindows DLL search-order and signed-executable trust model within the QN Wallpaper application directory
MechanismMalicious libcef.dll placed in the installation directory is loaded automatically by the signed QnWallpaper.exe before any system-path equivalent, executing within the signed process's security context without triggering signature-based controls
ImpactFull backdoor access enabling keylogging, clipboard and screenshot theft, persistent code injection into svchost.exe, and loading of additional attacker-controlled modules; Windows Defender disabled prior to execution
DetectionDisableAntiSpyware registry value set at installation time; unexpected libcef.dll in C:\Program Files\QNWallpaper\5.4.0.1662\; outbound connections from QnWallpaper.exe or svchost.exe to 103.45.66.18 or 192.253.225.173; critical-process flag on non-system processes causing BSOD on termination
MitigationRemove QN Wallpaper installations matching the known install path; block C2 IPs at perimeter; restore Windows Defender configuration via registry; hunt and remediate using published IoCs
Exploitation status

No CVE exploitation involved; Silver Fox is actively delivering ValleyRAT via a trojanised QN Wallpaper adware installer confirmed by Kaspersky analysis of an in-the-wild sample published 31 August 2026; a separate Silver Fox BYOVD campaign against a Japanese manufacturer in July 2026 exploited CVE-2023-52271, but that is a distinct operation.

Research process

The investigation began from the claim that Silver Fox was abusing signed adware to deliver ValleyRAT through DLL sideloading. The primary Kaspersky Securelist advisory was fetched and confirmed the infection chain, IoCs, and attribution. Parallel searches identified the Cato Networks July 2026 report on a separate Silver Fox campaign, which independently corroborated the group's established pattern of abusing legitimate signed executables and documented CVE-2023-52271 in a distinct BYOVD chain. The Nextron Systems November 2025 report was fetched to test the claim that libcef.dll appeared in a prior loader, but that campaign used a different DLL, leaving the specific lineage assertion unverified against a primary source. Multiple independent outlets corroborated the Kaspersky findings without contradiction, supporting a high-confidence assessment on the event itself, with a material uncertainty around campaign scale.

  1. Which primary source covers this specific campaign?
    Searched for ValleyRAT Silver Fox QN Wallpaper DLL sideloading Kaspersky 2026

    Kaspersky Securelist published the originating vendor analysis at securelist.com/valleyrat-backdoor-adware/121175/

    why Locating the primary vendor report establishes the evidentiary baseline before assessing secondary coverage

  2. What does the Kaspersky report actually state about the infection chain, IoCs, and scope?
    Fetched the Kaspersky Securelist report
    securelist.com ↗

    Confirmed: libcef.dll sideloaded via signed QnWallpaper.exe; three MD5 hashes and two C2 IPs documented; Windows Defender disabled via DisableAntiSpyware; ValleyRAT injected into svchost; Silver Fox attribution based on geography and payload; 100,000+ detections in 2026 across 1,500+ users (note: broader campaign metric)

    why Primary source verification; all IoCs and technical claims anchored here

  3. Does The Hacker News reporting reference any independent sources that should be verified?
    Fetched the THN article
    thehackernews.com ↗

    Confirmed Kaspersky findings; identified Cato Networks as having documented Silver Fox DLL sideloading five weeks prior against a Japanese manufacturer; asserted libcef.dll appeared in a 2025 loader without citing a specific report

    why Surfaced Cato Networks as an independent corroborating source; flagged the 2025 libcef.dll claim as requiring primary-source verification

  4. What did Cato Networks actually document about Silver Fox DLL sideloading in July 2026?
    Searched for Cato Networks Silver Fox blog and fetched the report
    catonetworks.com ↗

    Cato documented a campaign against a Japanese manufacturer using PDFCORE8.dll sideloaded via Zeon Corporation PDF tools, not libcef.dll; CVE-2023-52271 exploited in a three-driver BYOVD chain; confirms Silver Fox pattern of abusing signed legitimate executables

    why Provides independent corroboration of Silver Fox tradecraft from a different vendor; clarifies the libcef.dll claim in THN applies to earlier campaigns, not specifically the Cato July report

  5. Does the Nextron Systems 2025 report confirm prior libcef.dll usage by Silver Fox?
    Fetched the Nextron Systems November 2025 report
    nextron-systems.com ↗

    Nextron's campaign uses log.dll sideloaded via NtHandleCallback.exe, not libcef.dll; confirms Silver Fox DLL sideloading via signed executables was active by November 2025 but does not verify the specific libcef.dll lineage

    why Establishes a material uncertainty: the 2025 libcef.dll claim remains unverified against a primary source in available evidence

  6. Does Security Affairs provide independent corroboration of Kaspersky's findings?
    Fetched the Security Affairs article
    securityaffairs.com ↗

    Security Affairs confirms the same IoCs, campaign scope, and Silver Fox attribution; adds context from the Cato July 2026 report confirming the group's documented DLL sideloading evolution; no contradictions found

    why Second independent domain corroborating Kaspersky findings; strengthens confidence in attribution and technical detail

Named in this story
ActorsSilver FoxUTG-Q-1000Void ArachneSwimSnake
MalwareValleyRATWinos 4.0
TargetsWindows users in China and Indiaorganisations whose users install adware from unverified sources

Research coverage

All 73 registered source leaves were evaluated for this run: 63 completed, 0 were unavailable, 3 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 62 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 73 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok7 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
BleepingComputernews ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CERT-EU Threat Intelligencenews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1687 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5333 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok689 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1013 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok8075 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1591 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok3 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
SentinelLabsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos X-Opsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The DFIR Reportnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit 42news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
WeLiveSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Additional verified pages 6 opened outside the registered collection
References & evidence
Vendor & gov advisories1
ValleyRAT is spreading disguised as adware – Kaspersky Securelist securelist.com ↗

Primary vendor analysis; full infection chain, IoCs, and Silver Fox attribution

Analysis & research4
SilverFox Evolves: Trusted Software Hijacking Delivers ValleyRAT – Cato CTRL catonetworks.com ↗

July 2026 independent report documenting Silver Fox DLL sideloading against a Japanese manufacturer; CVE-2023-52271 BYOVD chain detailed

ValleyRAT: When Legitimate Software Becomes a Malware Delivery Tool – Security Affairs securityaffairs.com ↗

Independent corroboration of Kaspersky findings and Silver Fox attribution

Thor vs. Silver Fox: Uncovering and Defeating a Sophisticated ValleyRAT Campaign – Nextron Systems nextron-systems.com ↗

November 2025 report establishing Silver Fox DLL sideloading via signed executables predates this campaign; uses log.dll/NtHandleCallback.exe variant

SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain – The Hacker News thehackernews.com ↗

July 2026 coverage of Silver Fox BYOVD campaign; independently confirms group's ongoing abuse of legitimate signed executables for sideloading