Actor Profile

Silver Fox is a threat actor attributed by Kaspersky to campaigns distributing the ValleyRAT backdoor (also tracked as Winos 4.0). The group has demonstrated consistent use of DLL sideloading techniques leveraging legitimate, signed software to evade detection. Previous campaigns attributed to Silver Fox include tax-themed operations targeting organizations in India and Russia, and attacks against a Japanese manufacturer documented by Cato Networks approximately five weeks prior to this campaign. The actor's motivation appears to be espionage and data theft, with operations primarily affecting victims in China and India.

TTPs (Tactics, Techniques, Procedures)

Silver Fox employs DLL sideloading (T1574.002) as a core technique, planting malicious libcef.dll alongside legitimate signed executables like QnWallpaper.exe. The group disables Windows Defender via the DisableAntiSpyware registry key (T1562.001 - Impair Defenses) and establishes persistence through autorun entries (T1547.001 - Registry Run Keys). When lacking administrator privileges, the malware uses runas for privilege escalation (T1548). ValleyRAT marks its process as critical to prevent termination (T1489 - Service Stop), triggering blue screen crashes if interrupted. The backdoor provides full remote control capabilities including keylogging (T1056.001), clipboard monitoring (T1115), screen capture (T1113), and delivery of additional modules (T1105 - Ingress Tool Transfer). C2 communication occurs over multiple ports (441, 442, 443, 6666, 8888).

Targets & Patterns

Kaspersky recorded over 100,000 ValleyRAT detections affecting more than 1,500 unique users throughout 2026, with victims concentrated primarily in China and India. Previous Silver Fox campaigns have targeted organizations in India and Russia (tax-themed operations) and a Japanese manufacturer. The use of Chinese adware (QN Wallpaper) as a disguise suggests targeting of Chinese-speaking users or those seeking Chinese-language software. The attack vector exploits user trust in signed software and the common practice of adding adware to antivirus exclusions, making it effective against both individual users and potentially corporate environments where software policies are lax.

Historical Context

Silver Fox has demonstrated consistent operational patterns across multiple campaigns. Cato Networks documented the group's abuse of legitimate applications for DLL sideloading in an attack against a Japanese manufacturer approximately five weeks before this campaign. The same libcef.dll filename was previously featured in a 2025 ValleyRAT loader, indicating reuse of infrastructure and techniques. Kaspersky previously tracked Silver Fox in tax-themed campaigns targeting India and Russia. The group's sustained use of DLL sideloading through signed software represents an established component of their toolkit, showing tactical continuity across operations spanning at least 2025-2026.

Defensive Recommendations

  • Monitor for DLL sideloading activity (T1574.002) by detecting unsigned DLLs loaded by signed processes, particularly libcef.dll loaded by non-Chromium applications
  • Alert on registry modifications to DisableAntiSpyware key (HKLM\SOFTWARE\Policies\Microsoft\Windows Defender) and block unauthorized changes via Group Policy
  • Implement application control policies to prevent execution of software from questionable sources and prohibit adding third-party software to antivirus exclusions without approval
  • Monitor for privilege escalation attempts using runas.exe (T1548) and processes marking themselves as critical via RtlSetProcessIsCritical API calls
  • Block or monitor network connections to known Silver Fox C2 infrastructure: 103.45.66.18 (ports 441-443) and 192.253.225.173 (ports 6666, 8888), and hunt for the provided file hashes (MD5: c24e99f9437feacaa63766a3cde3fe3d, 07ddbbe2c71c45577a7a4fbcdba0df91, 8a626d844943da3456b044f38deae3a2)