Executive Summary
In a sophisticated campaign detected throughout 2026, the Silver Fox threat group has been observed distributing the ValleyRAT backdoor under the guise of legitimate Chinese adware, specifically 'QN Wallpaper'. By using signed adware installers, the attackers increase the likelihood of users manually white-listing the malicious components. The campaign has primarily affected over 1,500 unique users across China and India.
The attack chain involves a multi-stage process starting with a malicious installer that drops a modified wallpaper tool to perform DLL side-loading via a spoofed 'libcef.dll'. Once active, ValleyRAT provides the adversary with extensive control over the compromised host, including keylogging, clipboard monitoring, and the ability to load additional purpose-built modules. The threat is motivated by a combination of cyberespionage and potential financial gain, given its targeting of workplace collaboration platforms and sensitive system data.