Silver Fox delivered ValleyRAT through signed adware that users whitelist themselves

After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe.

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.

Kaspersky said the attack's geography and payload point to Silver Fox as the likely group behind it.

Regardless of the file name, the installer deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper (qnwallpaper[.]keansoft[.]cn) and adds it to the registry's autorun entries; the original version is genuine adware that delivers bundled partner apps and displays ad banners.

The QN Wallpaper modules and malicious components are unpacked to C:\Program Files\QNWallpaper\5.4.0.1662\<random string of letters and digits>.

QnWallpaper.exe has dependencies in libcef.dll, so the library is loaded when the process starts; QnWallpaper.exe also launches QnwPlayer.exe, which likewise calls libcef.dll. With the library executing inside a legitimately signed process, the backdoor runs without triggering controls that trust the signature.

QnWallpaper and QnwPlayer will not function correctly because the functions exported from libcef.dll are put into an infinite sleep; in case that sleep is ever interrupted, the attackers implemented a function that loads all necessary functions from the original library into memory, provided it can locate that library on the system.

The malicious functionality in libcef.dll is invoked by a call to DllMain, which runs automatically when the library is loaded; the library also contains an export named RunDLL that also initiates the malicious code and that QnWallpaper never calls. Kaspersky suspects the attackers intended to invoke it manually via rundll32 or planned to use a separate executable not included in the downloaded package.

Inside the function Kaspersky calls mw_entry, the malware checks whether the current user belongs to the Administrators group and which process the DLL is running inside; if the user is not an Administrators member, it attempts to obtain administrator privileges using the runas utility.

Once it has administrator privileges, the code selects the payload by host process: loaded from the PeLoader file when running inside QnWallpaper.exe, and from a libcef.dll resource when running inside QnwPlayer.exe.

ValleyRAT can flag its own process as critical, so that any attempt to terminate it triggers a blue screen of death.

Kaspersky said ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules.

Kaspersky's account is based on a single installer submitted by a customer, and the report stops short of attaching a victim count to the adware route.

In a campaign against a Japanese manufacturer about five weeks earlier, Cato Networks documented what it called Silver Fox's newly observed abuse of legitimate applications for DLL sideloading, and the same libcef.dll filename had already featured in a 2025 ValleyRAT loader.

Kaspersky tracked the same group in an earlier tax-themed campaign against organizations in India and Russia.

The attackers may have chosen this distribution method because the adware was signed by the developer, and because users often manually add these apps to exclusions so their useful features do not get blocked.

When the library is loaded, code runs that ensures QnWallpaper.exe persists at startup by adding a file extension association and dropping a file with the corresponding extension in the user's Start Menu Programs Startup directory.

The installer performed different actions depending on the two-letter suffix used in the file name, positioned just before the numeric string; these actions are most likely designed to divert the user's attention away from the malicious functionality.

Kaspersky listed command-and-control servers 103.45.66.18 on ports 441, 442 and 443, and 192.253.225.173 on ports 6666 and 8888.

Domains in the chain include qnwallpaper[.]keansoft[.]cn, the abused adware's download site, and meeting[.]tencent[.]com, a legitimate page opened as a decoy.

Kaspersky urged users to avoid installing software of questionable reputation and never to add such software to security solutions' exclusion lists, and urged organisations to set clear policies on third-party software on work devices.

Taking Kaspersky's two 2026 floors at face value gives roughly 67 detections per affected user.

Across 2026 Kaspersky recorded more than 100,000 detections of ValleyRAT and associated malware affecting over 1,500 unique users, mostly in China and India, a figure spanning all of the year's ValleyRAT activity rather than this campaign alone.