InfoSecBulletin Cybersecurity for mankind
A new malware campaign targets users by misusing their trust in popular apps. Cybercriminals are spreading fake installers for Telegram, WinSCP, Google Chrome, and Microsoft Teams to install ValleyRat, a remote access trojan for long-term system takeover. The campaign has been attributed to the China-aligned APT group known as Silver Fox, which has remained active since at least 2022.
The infection starts when victims download fake application installers from spear-phishing emails or harmful ads. Users see a regular installation interface, but unseen processes run quietly in the background.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
The malware organizes files, installs kernel-level drivers, interferes with endpoint security, and activates a ValleyRat beacon for ongoing access to the hacked system.
Nextron Systems security researchers identified this campaign through their detailed analysis of the entire infection chain.
The investigation found that attackers use various methods to avoid detection, including obfuscation, tampering with endpoint security, and kernel-level techniques to communicate with remote servers.
The distribution primarily occurs through trojanized Telegram installers. One analyzed sample, named tg.exe, carries the SHA-256 hash 9ede6da5986d8c0df3367c395b0b3924ffb12206939f33b01610c1ae955630d1.
Despite displaying a genuine Telegram Desktop 6.0.2 interface, closer inspection reveals notable inconsistencies.
The PE header timestamp is from 2019, and the first VirusTotal submission was in August 2025, indicating a strange six-year gap for a regularly updated application.
Infection Mechanism and Defense Evasion:
The installer saves files in C:\ProgramData\WindowsData\, including a renamed 7-Zip binary (funzip.exe) and an encrypted file disguised as main.xml.
The malware then uses PowerShell to add a Microsoft Defender exclusion for the entire C:\ drive, effectively silencing antivirus protection.
The archive extraction command reveals the embedded password:-
“C:\ProgramData\WindowsData\funzip.exe” x -y -phtLcENyRFYwXsHFnUnqK -o”C:\ProgramData\WindowsData” “C:\ProgramData\WindowsData\main.xml”
This extraction deploys men.exe, the main orchestrator that performs environmental reconnaissance by scanning for security processes, including Microsoft Defender’s MsMpEng.exe and Chinese security products like ZhuDongFangYu.exe and 360tray.exe.
The campaign maintains persistence using a scheduled task called WindowsPowerShell.WbemScripting.SWbemLocator, which imitates real Windows components. It runs an encoded VBScript that activates the ValleyRat beacon for ongoing system access.
