[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fraoH4Nruli0SHyAu1c429cOITu0z2eYh9kIqK1aEG04":3},{"article":4,"iocs":45,"watch_terms":81,"solutions":82,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"b6b33480-224a-4f0e-9cb0-11fc7a0ed06d","ValleyRAT masquerading as adware","valleyrat-masquerading-as-adware-f0e556","Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.","Threat actors are distributing the ValleyRAT backdoor disguised as adware, using a malicious installer that masquerades as legitimate software. The installer deploys a modified adware tool, QN Wallpaper, which is then used for DLL sideloading to execute the backdoor. The infection chain also includes disabling Windows Defender and potentially other diversionary tactics.","ValleyRAT backdoor distributed as adware via malicious installer.","https:\u002F\u002Fsecurelist.com\u002Fvalleyrat-backdoor-adware\u002F121175\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F08\u002F28184605\u002FSL-valleyRAT-abuses-adware-featured-scaled-1.jpg","2026-08-31T10:00:21+00:00","2026-08-31T12:00:16.781551+00:00",8,[17,20,23,25],{"name":18,"type":19},"QN Wallpaper","product",{"name":21,"type":22},"DLL Sideloading","technology",{"name":24,"type":19},"DingTalk",{"name":26,"type":19},"Google Chrome","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,54,57,60,63,66,69,72,75,78],{"type":47,"value":48,"context":49},"url","hxxps:\u002F\u002Fqnwallpaper[.]keansoft[.]cn\u002F","QN Wallpaper domain",{"type":51,"value":52,"context":53},"hash_md5","c24e99f9437feacaa63766a3cde3fe3d","Malicious installer sample",{"type":51,"value":55,"context":56},"7ad1e3ef4e6d9d636c9e7e967733850e","Archive containing adware files",{"type":51,"value":58,"context":59},"96b4c1d0683dce22bd3223e1e40689c1","7z archiver library",{"type":51,"value":61,"context":62},"9b86d3ab6cef15c633933fbbeab39c0a","7z archiver executable",{"type":51,"value":64,"context":65},"edfdc30cbd85879776b8f735ea7de1f1","Library used to launch Electron-based applications",{"type":51,"value":67,"context":68},"07ddbbe2c71c45577a7a4fbcdba0df91","Malicious DLL (libcef.dll)",{"type":51,"value":70,"context":71},"48826d5ca845979d2e6ebd66dc1aae90","File containing encrypted backdoor (PeLoader)",{"type":51,"value":73,"context":74},"6c158c0f8e029342192d4f0d72e102b7","Adware module (QnWallpaper.exe)",{"type":51,"value":76,"context":77},"9a71d6a41cd258b9e89cdc5fc224de73","Adware module (QnwPlayer.exe)",{"type":47,"value":79,"context":80},"hxxps:\u002F\u002Fmeeting[.]tencent[.]com\u002Fdownload\u002F","Potential diversion URL",[18,24,26],{"controls":83,"vendors":160},[84,105,131],{"slug":85,"name":86,"problem":87,"products":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[89,97],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":106,"name":107,"problem":108,"products":109},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":127,"product_name":128,"url":129,"description":130},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"slug":132,"name":133,"problem":134,"products":135},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[136,144,152],{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":176},"valleyrat-backdoor-hidden-inside-fake-adware-installer","ValleyRAT Backdoor Hidden Inside Fake Adware Installer","Threat actors are exploiting users' trust in seemingly legitimate software by bundling the ValleyRAT backdoor inside a malicious installer disguised as adware. The attack leverages DLL sideloading through a modified version of QN Wallpaper, a technique that abuses trusted application processes to execute malicious code under the radar. Critically, the malware also disables Windows Defender, stripping away a key layer of host-based protection. This campaign highlights how social engineering combined with living-off-the-land techniques can bypass traditional defenses when users download software from unverified sources. Organizations without strict software installation policies and endpoint controls are particularly exposed.",[166,167,168,169,170,171,172,173,174,175],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1574.002: DLL Side-Loading","MITRE ATT&CK T1562.001: Impair Defenses - Disable or Modify Tools","GDPR Article 32: Security of Processing (for organizations handling personal data on affected systems)",{}]