Stealth Injection: Silver Fox APT Upgrades “ValleyRat” with Rare PoolParty Tech

Cybereason reports a campaign distributing ValleyRat (Winos 4.0) via fake installers targeting Chinese-speaking users; the malware uses an uncommon "PoolParty Variant 7" I/O completion port process-injection (duplicating Explorer.exe handles and calling ZwSetIoCompletion) to execute stealthily, implements an injected watchdog for resilient persistence (into Explorer.exe and UserAccountBroker.exe), and actively interferes with Chinese security products (e.g., Qihoo 360 processes). The activity is linked to the Silver Fox APT and shares tradecraft similarities with SADBRIDGE, and users are advised to verify digital signatures and certificates carefully.