As reported by The Hacker News, Kaspersky has documented Silver Fox distributing the ValleyRAT backdoor (also tracked as Winos 4.0) hidden inside a legitimately signed Chinese adware application called QN Wallpaper. The campaign is a textbook case of how threat actors exploit the gap between signature trust and behavioral trust — and it deserves more attention than a single vendor report tends to generate.

Threat Alert: The campaign is a textbook case of how threat actors exploit the gap between signature trust and behavioral trust — and it deserves more attention than a single vendor report tends to generate.

The Trust Model Problem Nobody Wants to Fix

The core issue here isn't novel malware. It's that the industry's reliance on code signing as a trust indicator has always been structurally weak. A valid Authenticode signature confirms origin, not intent. When users — and many endpoint products — treat signed binaries as inherently safe, attackers simply need to co-opt a signed process. DLL sideloading does exactly that: the signed executable loads whatever library is in its working directory, and if an attacker plants a malicious libcef.dll alongside it, the payload runs inside a trusted process context.

This isn't a vulnerability in QN Wallpaper. It's a feature of how Windows library loading works — and vendors of signed software that don't enforce DLL integrity are unwittingly handing attackers a delivery vehicle.

Why the Antivirus Exclusion Angle Is the Real Story

The most dangerous element of this campaign is the social engineering around exclusions. Adware vendors routinely instruct users to add their software to antivirus exclusion lists to prevent false positives or interference with their bundling behavior. Silver Fox is exploiting a behavioral pattern that the adware industry itself normalized. Once a user adds a directory to exclusions, no amount of EDR sophistication matters — the product is blind by configuration.

Defenders should treat antivirus exclusions as a high-risk configuration change requiring approval, documentation, and periodic review. In enterprise environments, exclusion lists should be locked down via Group Policy and audited monthly. Any exclusion pointing to a user-writable directory is a standing invitation for exactly this kind of attack.

The BSOD Trick Complicates Incident Response

ValleyRAT's ability to flag its own process as critical — causing a blue screen of death on termination — is an anti-recovery mechanism that deserves specific attention. This is achieved through RtlSetProcessIsCritical, a documented Windows API that marks a process as essential to system operation. When an incident responder or automated cleanup tool kills the process, the system crashes, potentially destroying volatile evidence and disrupting containment.

This means standard "kill the process, clean the registry" playbooks will fail. Responders need to:

Why the Antivirus Exclusion Angle Is the Real Story
Capture memory before terminating any suspected ValleyRAT process
Disable autorun entries and the DisableAntiSpyware registry key first, then reboot rather than killing the live process
Collect forensic artifacts from disk post-reboot, when the process is no longer marked critical

Silver Fox's Escalation Pattern

The Cato Networks report on Silver Fox targeting a Japanese manufacturer roughly five weeks prior suggests this group is scaling and diversifying. The shift from regional Chinese-language targets to a Japanese industrial victim indicates broadening operational scope. Organizations with manufacturing operations, supply chain relationships in East Asia, or employees who install regional software tools should consider themselves in the threat actor's expanded footprint.

Shield53 Recommendations

  • Audit all antivirus and EDR exclusion lists immediately. Remove any exclusion for user-writable directories or software of questionable reputation. Replace broad path exclusions with certificate-based exclusions where possible.
  • Deploy detection rules for the DisableAntiSpyware registry modification. Monitor HKLM\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware and alert on any value change regardless of source.
  • Enable DLL loading controls. Where feasible, enforce Microsoft Defender Application Control (WDAC) or AppLocker policies that restrict unsigned DLLs from loading into signed processes in non-standard directories.
  • Hunt for the published IoCs. Block and scan for the C2 IPs (103.45.66.18, 192.253.225.173), the malicious DLL hash (07ddbbe2c71c45577a7a4fbcdba0df91), and the install path C:\Program Files\QNWallpaper\.
  • Update IR playbooks to account for critical-process anti-termination techniques — prioritize memory capture and clean reboot over live process termination.
  • Restrict user software installation rights. The runas escalation path only works because users can install software in the first place. Least privilege remains the most effective control against adware-borne threats.