ValleyRAT Malware Uses Stealthy Driver Install to Bypass Windows 11 Protections

ValleyRAT (aka Winos/Winos4.0) is a sophisticated modular Windows remote-access trojan featuring a kernel-mode rootkit that can bypass protections on updated Windows 11 systems, plugin-based escalation and credential theft capabilities, and aggressive removal of security/EDR drivers; the public leak of the builder has increased accessibility to a broader range of threat actors and researchers observed a surge in samples over the past six months.