The threat group Silver Fox has been caught distributing the ValleyRAT backdoor by hiding it inside a digitally signed Chinese adware program, allowing the malware to run under a trusted process and slip past users who exclude such software from antivirus scans. Russian cybersecurity firm Kaspersky published the findings, saying the attackers wrapped their malware around QN Wallpaper, a legitimate Chinese desktop-wallpaper application that in its unaltered form is adware, bundling partner software and showing ad banners. Once active, ValleyRAT—also called Winos 4.0—grants the operator complete control of the infected computer.
The disguise works through DLL sideloading, according to Kaspersky. The installer drops a modified version of QN Wallpaper and launches its signed executable, QnWallpaper.exe, which then loads a malicious libcef.dll file placed in the same folder. Because the library runs inside a legitimately signed process, the backdoor executes without triggering security controls that rely on the signature. Before the adware portion launches, the installer turns off Windows Defender using the DisableAntiSpyware registry key and adds the program to the system's autorun entries. When the logged-in user doesn't have administrator rights, the malware relaunches itself with runas to get them. ValleyRAT can also mark its own process as critical, meaning any attempt to kill it causes a blue screen of death. Kaspersky shared indicators of compromise including three file hashes, two command-and-control servers at 103.45.66.18 and 192.253.225.173, domains including the abused adware's download site at qnwallpaper[.]keansoft[.]cn, the DisableAntiSpyware registry value, and the install directory C:\Program Files\QNWallpaper\5.4.0.1662\. Throughout 2026 the vendor logged more than 100,000 detections of ValleyRAT and related malware hitting over 1,500 unique users, mostly in China and India—a count covering all of the year's ValleyRAT activity rather than just this campaign.
"This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear," Kaspersky said in its analysis. "ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules." The report noted that the attack's geography and payload suggest Silver Fox as the probable group responsible. DLL sideloading via signed, legitimate software is an established element of Silver Fox's methods, the vendor added. In a campaign targeting a Japanese manufacturer roughly five weeks earlier, Cato Networks documented what it described as the group's "newly observed abuse of legitimate applications for DLL sideloading," and the same libcef.dll filename had already appeared in a 2025 ValleyRAT loader. Kaspersky itself monitored the group in an earlier tax-themed campaign against organizations in India and Russia.
Kaspersky's report is built on a single installer submitted by a customer; its advertising features remain inactive while the infection chain executes, and the account doesn't attach a victim count to the adware route. The vendor urged organizations to establish clear policies on third-party software on work devices and to keep employees informed of the threat. "For individual users, we recommend avoiding the installation of software with a questionable reputation, and, even more importantly, never adding such software to your security solutions' exclusion lists," the company said. DLL sideloading through signed binaries has emerged as a persistent challenge for endpoint defenses, since the technique leverages the trust model built into operating systems and security tools rather than exploiting a vulnerability. As adware distribution networks increasingly serve as vehicles for serious threats, security teams face a choice between locking down software sources or accepting the monitoring overhead that comes with tracking legitimate-but-risky tools across every workstation.