SilverFox Campaign Turns ValleyRAT Into Multi-Stage Malware With Rootkit Capabilities

SilverFox, a Chinese-affiliated APT, has upgraded the ValleyRAT toolset into an eight-stage infection chain that ends with a sophisticated kernel-mode rootkit. The campaign uses signed binary DLL sideloading, ETW/AMSI bypasses, PNG steganography to hide shellcode, reflective in-memory loaders (Donut), and C2 over WebSocket and QUIC; it includes AV-killer modules, named-pipe plugin delivery, polymorphic sample rotation, and data-stealing modules (crypto clipboard hijack, Telegram credential theft), with observed targeting across India, Russia and APAC.