[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQrPr_36G1E-4VHJLgn-EhlchTBymhnQ_lkBAxE-a65I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"a13bd7e8-e167-4b16-9da8-ab142106941e","signed-adware-used-as-trojan-horse-to-deliver-valleyrat-backdoor","e4584378-a201-4eb1-a7e3-17709fd9b376","Signed Adware Used as Trojan Horse to Deliver ValleyRAT Backdoor","The Silver Fox threat actor exploited user trust by disguising the ValleyRAT backdoor as a legitimately signed Chinese adware application (QN Wallpaper), tricking users into adding it to antivirus exclusion lists — effectively disabling the very controls designed to catch it. The attack leverages DLL sideloading, a technique where a malicious library hijacks a trusted, signed executable, allowing malware to operate under a legitimate process and evade detection. Once established, the malware disables Windows Defender and persists via autorun entries, compounding the damage. This attack succeeds primarily because users lack the awareness to critically evaluate software trustworthiness, and because security configurations allow user-level modification of antivirus exclusions. It highlights how digital signatures alone are insufficient trust indicators and how social engineering can undermine technical controls.","**Immediate actions:**\n- Audit and remove any unauthorized or user-added antivirus exclusions across all managed endpoints immediately.\n- Deploy application allowlisting to prevent unsigned or unapproved executables and DLLs from running on corporate systems.\n- Search endpoint telemetry for indicators of compromise related to QN Wallpaper, ValleyRAT, and known Silver Fox TTPs.\n\n**Configuration hardening:**\n- Restrict standard user accounts from modifying antivirus or EDR exclusions through Group Policy or endpoint management platforms.\n- Enable Tamper Protection in Microsoft Defender (or equivalent) to prevent malware from disabling security tooling.\n- Monitor and alert on any new autorun registry entries (e.g., HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run) added outside of approved change processes.\n\n**Security awareness & long-term improvements:**\n- Train users to never add software to antivirus exclusion lists without formal IT approval, regardless of perceived legitimacy.\n- Implement a formal software vetting process requiring security review before any third-party application is installed on endpoints.\n- Adopt a Zero Trust posture that treats code-signing certificates as a necessary but insufficient trust signal, requiring behavioral validation as well.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 10: Malware Defenses","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AT-2: Literacy Training and Awareness","MITRE ATT&CK T1574.002: DLL Side-Loading","MITRE ATT&CK T1547.001: Registry Run Keys \u002F Startup Folder","MITRE ATT&CK T1562.001: Disable or Modify Tools",{},"published","2026-08-31T14:21:36.072234+00:00","2026-08-31T14:21:35.438+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fvalleyrat-backdoor-hides-in-signed.html","valleyrat-backdoor-hides-in-signed-adware-that-users-add-to-antivirus-exclusions-50276d","ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":57,"name":58,"problem":59},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":61,"name":62,"problem":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]