SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in Live ValleyRAT Campaign

The report details an active SilverFox campaign delivering a complex multi-stage RAT called ValleyRAT that uses DLL sideloading, repeated steganography, the Donut loader, and a Go-based RAT to deploy an AV-killer and a kernel rootkit; it targets corporate networks, steals cryptocurrency and Telegram data, persists via polymorphic builds and rotating file paths, and includes IoCs (SHA-256 hash and C2 domains) for detection and response.