As reported by SecurityAffairs, Kaspersky's latest analysis of ValleyRAT reveals a delivery mechanism that should give defenders pause: the Silver Fox threat group is repurposing a legitimate Chinese wallpaper application, QN Wallpaper, as a Trojan horse for their remote access trojan. The sophistication isn't in novel exploitation—it's in how mundane the delivery looks.
What makes this campaign noteworthy isn't the malware itself, which has been tracked since 2023, but the evolution of its social engineering. By modifying genuine adware rather than crafting a fake application from scratch, attackers inherit the trust signals that legitimate software carries: digital signatures, normal execution patterns, expected user interfaces. The installer can even masquerade as DingTalk, Tencent Meeting, or Chrome depending on filename, giving victims something familiar to interact with while ValleyRAT deploys silently.
The DLL Sideloading Problem Persists
The technical mechanism here—DLL sideloading via libcef.dll—is well-understood but remains stubbornly effective. The attack exploits a fundamental tension in how operating systems load libraries: when a signed, trusted executable looks for a DLL in its own directory before checking system paths, any attacker with write access to that directory can inject code that runs with the legitimate process's privileges and reputation.
The original QN Wallpaper is genuine adware that delivers bundled apps and displays advertisements. The attackers didn't invent a fake application—they weaponized the real one's execution flow.
This matters because traditional endpoint detection that relies on reputation scoring and signature validation of the parent process will see a legitimate application doing legitimate things. The malicious activity happens in a loaded module that inherits the parent's trust context.
The PUA Classification Trap
Perhaps the most revealing detail in Kaspersky's report is how this sample reached them: a customer submitted it requesting adware classification. Initial inspection confirmed that assessment. Only anomalous network traffic triggered deeper analysis. This exposes a genuine blind spot in many security programs.
Potentially unwanted applications occupy a gray zone that many organizations handle inconsistently. Some endpoint platforms classify PUAs as low-priority and don't block them by default. Security analysts may triage adware detections as noise. Threat actors understand this calculus and are designing payloads that exploit the gap between "annoying but harmless" and "active intrusion."
Who Is at Risk
Shield53 Recommendations
- Reclassify PUA handling: Treat adware and PUA detections as potentially malicious until proven otherwise. Configure endpoint platforms to block PUAs by default, not just alert. Investigate any PUA that exhibits network behavior beyond expected advertising telemetry.
- Enable DLL sideloading mitigations: Enforce SafeDLLSearchMode, restrict write permissions on application directories, and deploy endpoint detection rules that flag unsigned or untrusted DLLs loaded by signed processes—especially
libcef.dll, which appears frequently in sideloading campaigns. - Monitor for ValleyRAT indicators: Watch for suspicious network beaconing from wallpaper or browser-related processes, unexpected process injection activity, and systems contacting known ValleyRAT C2 infrastructure. Kaspersky's report contains IOIs that should be integrated into threat hunting workflows.
- Application allowlisting: In high-security environments, restrict execution of unapproved regional software. QN Wallpaper and similar bundling-heavy applications should require explicit approval before deployment.
- User awareness targeting: Brief users—particularly those in or interacting with Chinese-speaking regions—on the risks of wallpaper apps, system optimizers, and software bundled with advertising components. The familiar interface is the social engineering vector.
The broader lesson here extends beyond ValleyRAT. As defenders improve detection of overtly malicious payloads, threat actors are increasingly hiding within legitimate execution contexts. The line between adware and malware has always been thinner than security marketing suggests—Silver Fox is proving that the gap can be closed entirely when defenders aren't watching it.
