Operation Silk Lure: Chinese Espionage Targets FinTech with Malicious Resume LNK to Implant ValleyRAT

Seqrite Labs uncovered 'Operation Silk Lure', a targeted espionage campaign against Chinese FinTech and cryptocurrency firms that uses localized, malicious resume .LNK files to drop a PowerShell-based downloader which retrieves keytool.exe and jli.dll; the loader decrypts RC4-protected shellcode (RC4 key '123cba') exposing C2 206.119.175.16 and installs an evolved ValleyRAT backdoor that performs fingerprinting, keylogging, plugin delivery, anti-AV actions, and daily persistence via a scheduled task named 'Security'.