InfoSecBulletin Cybersecurity for mankind
A new malware campaign targets users by misusing their trust in popular apps. Cybercriminals are spreading fake installers for Telegram, WinSCP, Google Chrome, and Microsoft Teams to install ValleyRat, a remote access trojan for long-term system takeover. The campaign has been attributed to the China-aligned APT group known as Silver Fox, which has remained active since at least 2022.
The infection starts when victims download fake application installers from spear-phishing emails or harmful ads. Users see a regular installation interface, but unseen processes run quietly in the background.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The malware organizes files, installs kernel-level drivers, interferes with endpoint security, and activates a ValleyRat beacon for ongoing access to the hacked system.
Nextron Systems security researchers identified this campaign through their detailed analysis of the entire infection chain.
The investigation found that attackers use various methods to avoid detection, including obfuscation, tampering with endpoint security, and kernel-level techniques to communicate with remote servers.
The distribution primarily occurs through trojanized Telegram installers. One analyzed sample, named tg.exe, carries the SHA-256 hash 9ede6da5986d8c0df3367c395b0b3924ffb12206939f33b01610c1ae955630d1.
Despite displaying a genuine Telegram Desktop 6.0.2 interface, closer inspection reveals notable inconsistencies.
The PE header timestamp is from 2019, and the first VirusTotal submission was in August 2025, indicating a strange six-year gap for a regularly updated application.
Infection Mechanism and Defense Evasion:
The installer saves files in C:\ProgramData\WindowsData\, including a renamed 7-Zip binary (funzip.exe) and an encrypted file disguised as main.xml.
The malware then uses PowerShell to add a Microsoft Defender exclusion for the entire C:\ drive, effectively silencing antivirus protection.
The archive extraction command reveals the embedded password:-
“C:\ProgramData\WindowsData\funzip.exe” x -y -phtLcENyRFYwXsHFnUnqK -o”C:\ProgramData\WindowsData” “C:\ProgramData\WindowsData\main.xml”
This extraction deploys men.exe, the main orchestrator that performs environmental reconnaissance by scanning for security processes, including Microsoft Defender’s MsMpEng.exe and Chinese security products like ZhuDongFangYu.exe and 360tray.exe.
The campaign maintains persistence using a scheduled task called WindowsPowerShell.WbemScripting.SWbemLocator, which imitates real Windows components. It runs an encoded VBScript that activates the ValleyRat beacon for ongoing system access.
