Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Individual users and organizations in China and India
Incident: Distribution of the ValleyRAT backdoor via a modified version of the QN Wallpaper adware.
Impact: Full system compromise, sensitive data theft, and disabling of host-based security controls.
Attacker: Silver Fox
Analysis: The Silver Fox group is utilizing DLL sideloading within the signed QN Wallpaper application to execute the ValleyRAT backdoor. By exploiting the habit of users adding adware to antivirus exclusions, the malware disables Windows Defender and elevates its privileges. The backdoor provides full system control, including data exfiltration and the ability to trigger a system crash if terminated.
Recommendations: Restrict the installation of third-party software from unverified sources on corporate devices.; Avoid adding third-party applications to antivirus or EDR exclusion lists.; Monitor for unauthorized changes to the DisableAntiSpyware registry key and unusual DLL loads.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source