ValleyRAT Campaign Infrastructure Network Connections

Ethan Andrews@eandrews

•updated Feb 23, 2026•6•0•35

This rule identifies network connections to known command and control (C2) infrastructure and typosquatted domains associated with the ValleyRAT malware, specifically those used in the Huorong impersonation campaign. It looks for connections to a hardcoded malicious IP address or a list of malicious domains.