Silver Fox Sideloads ValleyRAT via Modified QN Wallpaper Installer, Disables Defender Through Registry

The observed campaign packages ValleyRAT inside an installer that drops a legitimate but modified QN Wallpaper binary alongside a trojanized libcef.dll. Execution occurs under the signed process, bypassing signature checks. The installer also toggles the DisableAntiSpyware registry value and registers itself for persistence. When non-admin rights are detected, it relaunches via runas. The same libcef.dll filename appeared in prior 2025 ValleyRAT loaders tracked by multiple vendors.

Kaspersky recorded over 100,000 ValleyRAT detections across 2026 affecting 1,500 users, concentrated in China and India, yet this adware vector rests on a single customer submission with no victim tally attached. Cato Networks documented Silver Fox abusing legitimate applications for DLL sideloading in a Japanese manufacturer campaign five weeks earlier. The pattern shows consistent reuse of adware affiliate infrastructure to reach targets that already tolerate bundled software.

Silver Fox has previously leveraged tax-themed lures against Indian and Russian organizations. The current route exploits user willingness to whitelist adware, turning routine exclusions into an operational advantage. No independent technical attribution beyond payload and infrastructure overlap confirms the group, while official statements rely on geography and known TTPs.

Expect continued abuse of signed Chinese utilities for sideloading. Defenders should audit exclusion lists for desktop customization tools and monitor for libcef.dll instances outside official directories within the next 60 days.