Silver Fox Campaign Distributes ValleyRAT via Counterfeit Installers

Microsoft and external researchers are tracking an active malware campaign attributed with moderate confidence to the Silver Fox (aka Yinhu) threat cluster. The attackers utilize high-fidelity clones of legitimate software sites (e.g., Microsoft Edge, Razer, Kaspersky) to trick users into downloading malicious archives. These payloads are frequently generated server-side to evade hash-based detection, leading to the deployment of ValleyRAT or Gh0st RAT.

The attack chain is characterized by aggressive defense evasion, including disabling Windows Update services, modifying discretionary access control lists (DACLs) via icacls to prevent file removal, and creating SYSTEM-level scheduled tasks to write Microsoft Defender exclusions. The malware targets a broad range of sectors, including healthcare, manufacturing, and government, with a primary focus on operations within China.

This campaign represents a significant risk due to its ability to neutralize host protections and establish long-term persistence through disguised scheduled tasks. The combination of automated delivery and occasional hands-on-keyboard activity suggests a sophisticated operation focused on both cyber espionage and potential financial gain.