Silver Fox Unleashes ValleyRAT backdoor via Signed Chinese Adware to Slip Past AV Exclusions

ValleyRAT backdoor Disguised as Signed Chinese Adware

The cyber‑crime crew identified as Silver Fox has begun packaging the ValleyRAT backdoor inside a legitimate‑looking Chinese wallpaper utility called QN Wallpaper. By signing the payload, the malicious code runs under a trusted process, fooling users who add the program to their antivirus exclusions. Kaspersky’s threat intel team reported that the adware carries a valid digital certificate, allowing it to bypass default security heuristics.

‘The attacker’s strategy relies on user trust in signed software,’ a Kaspersky analyst told Reuters.

Once the counterfeit QN Wallpaper is installed, the hidden backdoor establishes a covert channel to command‑and‑control servers, enabling data exfiltration and further payload delivery. Security researchers warn that the practice could increase infection rates by ↓ 30% among enterprises that whitelist the app. Defenders are urged to block unsigned execution paths and to verify code signatures against known benign hashes. For a deeper technical breakdown, see the analysis on Bloomberg.

Intel provided by Kaelen Frost (Lead Cybersecurity Analyst).