Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Cyber Incidents · IntelFusions threat intelligence

At a glance Campaign Counterfeit software-download / fake installer campaign Threat actor Consistent with Silver Fox (Yinhu); moderate-confidence, not nation-state Targets China-based operations and Chinese-speaking users; many sectors Delivery vector Spoofed vendor download sites serving trojanized installers Key capabilities Persistence, SYSTEM privilege abuse, Defender tampering, C2 Source Microsoft Defender Experts TL;DR Attackers built high-fidelity clones of popular software sites. Victims download fake software installers that quietly deploy malware.

Microsoft reported an active malware campaign that uses fake software-download sites to impersonate trusted vendors and deliver malicious installers, with victims across multiple industries and China-based operations. The activity is linked with moderate confidence to Silver Fox (Yinhu), and related reporting also ties ValleyRAT delivery to malicious installers and DLL sideloading...

Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.

Silver Fox is distributing ValleyRAT through a signed Chinese adware app, using DLL sideloading and trusted processes to evade security controls. Kaspersky linked the campaign to QN Wallpaper abuse, noted serious post-infection capabilities, and urged users and organizations to avoid questionable software and security exclusions. #SilverFox #ValleyRAT #QNWallpaper #Winos40 #Kaspersky...

Cyber Incidents · IntelFusions threat intelligence

The Silver Fox cybercrime group is distributing the ValleyRAT backdoor by using a DLL sideloading technique involving a legitimately signed adware...

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper, a genuine Chinese desktop-wallpaper tool