InfoSecBulletin Cybersecurity for mankind
A new malware campaign targets users by misusing their trust in popular apps. Cybercriminals are spreading fake installers for Telegram, WinSCP, Google Chrome, and Microsoft Teams to install ValleyRat, a remote access trojan for long-term system takeover. The campaign has been attributed to the China-aligned APT group known as Silver Fox, which has remained active since at least 2022.
The infection starts when victims download fake application installers from spear-phishing emails or harmful ads. Users see a regular installation interface, but unseen processes run quietly in the background.
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
The malware organizes files, installs kernel-level drivers, interferes with endpoint security, and activates a ValleyRat beacon for ongoing access to the hacked system.
Nextron Systems security researchers identified this campaign through their detailed analysis of the entire infection chain.
The investigation found that attackers use various methods to avoid detection, including obfuscation, tampering with endpoint security, and kernel-level techniques to communicate with remote servers.
The distribution primarily occurs through trojanized Telegram installers. One analyzed sample, named tg.exe, carries the SHA-256 hash 9ede6da5986d8c0df3367c395b0b3924ffb12206939f33b01610c1ae955630d1.
Despite displaying a genuine Telegram Desktop 6.0.2 interface, closer inspection reveals notable inconsistencies.
The PE header timestamp is from 2019, and the first VirusTotal submission was in August 2025, indicating a strange six-year gap for a regularly updated application.
Infection Mechanism and Defense Evasion:
The installer saves files in C:\ProgramData\WindowsData\, including a renamed 7-Zip binary (funzip.exe) and an encrypted file disguised as main.xml.
The malware then uses PowerShell to add a Microsoft Defender exclusion for the entire C:\ drive, effectively silencing antivirus protection.
The archive extraction command reveals the embedded password:-
“C:\ProgramData\WindowsData\funzip.exe” x -y -phtLcENyRFYwXsHFnUnqK -o”C:\ProgramData\WindowsData” “C:\ProgramData\WindowsData\main.xml”
This extraction deploys men.exe, the main orchestrator that performs environmental reconnaissance by scanning for security processes, including Microsoft Defender’s MsMpEng.exe and Chinese security products like ZhuDongFangYu.exe and 360tray.exe.
The campaign maintains persistence using a scheduled task called WindowsPowerShell.WbemScripting.SWbemLocator, which imitates real Windows components. It runs an encoded VBScript that activates the ValleyRat beacon for ongoing system access.
