Executive Summary
The SilverFox APT, a threat actor likely originating from China, has been observed conducting a campaign using lookalike Microsoft Teams domains to distribute a variant of ValleyRAT. The attack begins with social engineering, luring users to download a trojanized NSIS installer that masquerades as legitimate software while silently dropping malicious components.
The technical execution is characterized by a sophisticated multi-stage loader chain that abuses a legitimate Tencent executable (GameBox.exe) to sideload a malicious DLL. The malware implements several evasion techniques, including modifying Windows Defender exclusions, using hidden file attributes, and executing encrypted shellcode entirely in memory to avoid detection.
This campaign poses a significant risk to organizational data as ValleyRAT provides the attackers with full remote access, clipboard theft capabilities, and keylogging. The use of dynamic third-stage payloads fetched from C2 infrastructure allows the threat actors to adapt their objectives in real-time.