[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foP4R7lcSkfCIC_npA21N781u-jQ8ZWg0cV_s7F7WzC8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"ce3c6799-bc88-478d-86d5-4404280c8d63","valleyrat-backdoor-hidden-inside-fake-adware-installer","b6b33480-224a-4f0e-9cb0-11fc7a0ed06d","ValleyRAT Backdoor Hidden Inside Fake Adware Installer","Threat actors are exploiting users' trust in seemingly legitimate software by bundling the ValleyRAT backdoor inside a malicious installer disguised as adware. The attack leverages DLL sideloading through a modified version of QN Wallpaper, a technique that abuses trusted application processes to execute malicious code under the radar. Critically, the malware also disables Windows Defender, stripping away a key layer of host-based protection. This campaign highlights how social engineering combined with living-off-the-land techniques can bypass traditional defenses when users download software from unverified sources. Organizations without strict software installation policies and endpoint controls are particularly exposed.","**Immediate actions:**\n- Block execution of unauthorized or unverified installers by enforcing application allowlisting on all endpoints.\n- Re-enable and lock Windows Defender (or equivalent EDR) settings via Group Policy to prevent tampering by malicious software.\n- Scan all endpoints for indicators of compromise associated with ValleyRAT and QN Wallpaper using up-to-date threat intelligence feeds.\n\n**Long-term improvements:**\n- Establish and enforce a formal software approval and procurement policy that restricts installation to vetted, business-approved applications only.\n- Implement DLL sideloading detection rules within your EDR or SIEM to flag abnormal DLL load behavior from known-good applications.\n- Maintain a continuously updated software inventory (CMDB) to quickly identify unauthorized or rogue applications across the environment.\n\n**Detection measures:**\n- Configure SIEM alerting for security tool disablement events, such as Windows Defender being turned off outside of approved maintenance windows.\n- Deploy behavioral analysis tools capable of detecting unusual parent-child process relationships indicative of DLL sideloading attacks.\n- Conduct regular user awareness training focused on the risks of downloading software from unofficial or untrusted sources.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST CSF DE.CM-4: Malicious Code Detection","MITRE ATT&CK T1574.002: DLL Side-Loading","MITRE ATT&CK T1562.001: Impair Defenses - Disable or Modify Tools","GDPR Article 32: Security of Processing (for organizations handling personal data on affected systems)",{},"published","2026-08-31T12:21:09.210235+00:00","2026-08-31T12:21:08.906+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurelist.com\u002Fvalleyrat-backdoor-adware\u002F121175\u002F","valleyrat-masquerading-as-adware-f0e556","ValleyRAT masquerading as adware",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":44,"name":45,"slug":46,"description":47,"color":48},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"4a5cefe2-dd14-4f5b-a6cd-9cfbda37239f","2026-08-31","afternoon","ThreatNoir Afternoon Brief — August 31","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-31\u002Fthreatnoir-afternoon-brief-2026-08-31.mp3",[57,61,65],{"slug":58,"name":59,"problem":60},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":62,"name":63,"problem":64},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":66,"name":67,"problem":68},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]