FlagThis — Daily Cybersecurity Intelligence Briefing

The threat actor Silver Fox is utilizing a sophisticated delivery chain to deploy the ValleyRAT Remote Access Trojan (RAT) by weaponizing the legitimate, digitally signed QN Wallpaper adware. The attack employs DLL sideloading, where the trusted QN Wallpaper executable is manipulated to load a malicious DLL containing the ValleyRAT payload. This technique exploits the inherent trust placed in digitally signed binaries and leverages common security configurations where users or administrators add known adware to antivirus exclusion lists. Once execution is achieved, the malware provides full remote system control and data exfiltration capabilities while operating under the guise of a legitimate, trusted process.