New Silver Fox Campaign Hides ValleyRAT Inside Fake Telegram Chinese Language Pack Installer
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A new malware campaign linked to the Silver Fox APT group has been discovered, using a fake Telegram Chinese language pack installer to secretly deliver ValleyRAT \u2014 a powerful remote access trojan \u2014 onto targeted machines. <\/p>\n
The malicious file, disguised as a routine MSI installer, first appeared on MalwareBazaar on April 8, 2026, reported by security researcher CNGaoLing.<\/a><\/p>\n Silver Fox, also tracked as SwimSnake, UTG-Q-1000, and Void Arachne, is a Chinese-nexus cybercrime group with a long history of impersonating widely used Chinese-language software to lure victims. <\/p>\n Past campaigns have used fake installers for Teams, Zoom, Signal, and even Taiwan tax tools. <\/p>\n This newest operation follows the same approach, hiding malware inside what appears to be a Telegram language configuration file \u2014 a type of package that many Chinese-speaking users would treat as harmless and install without hesitation.<\/a><\/p>\n Breakglass Intelligence analysts identified this campaign<\/a> and noted that it deploys a six-stage infection chain built specifically to evade popular Chinese antivirus products, including Qihoo 360, Tencent PC Manager, and Huorong. <\/p>\n The tooling, infrastructure, and operator behavior all match the Silver Fox threat cluster with high confidence.<\/a><\/p>\n The malicious file \u2014 a.msi, internally labeled IssueAccentRequest, and built on March 24, 2026 \u2014 uses the WiX Toolset framework and is engineered to stay hidden from the Windows Add\/Remove Programs list. <\/p>\n Once execution is complete, the ValleyRAT payload<\/a> begins communicating with command-and-control server 118.107.43.65 on port 5040, hosted by CTG Server Ltd in Hong Kong \u2014 a bulletproof hosting provider that has appeared in multiple prior Silver Fox operations.<\/a><\/p>\n The full scope of damage is significant. A secondary binary, DesignAccent.exe, deploys as a scheduled task and is believed to carry screenshot or steganographic communication capabilities. <\/p>\n The wnBios kernel rootkit<\/a>, loaded via a Bring Your Own Vulnerable Driver technique, gives the attacker direct read and write access to physical memory, enabling them to disable kernel-level security tools and conceal the malware\u2019s presence from the operating system.<\/a><\/p>\n The most technically complex part of this campaign is its six-step infection process, which moves from an innocent-looking MSI file to full system compromise.<\/a><\/p>\n When a victim runs a.msi, a VBScript custom action triggers immediately after file extraction, executing with full SYSTEM privileges. <\/p>\n The script deploys a legitimate, signed copy of the zpaqfranz v60\u2013v63.2 archival tool \u2014 renamed to KhDzetMjQMsAGYw.exe \u2014 as a Living-off-the-Land Binary to decompress two nested ZPAQ archives. <\/p>\n The outer archive has no password; the inner archive is protected by the password 1427aafwqYOGGlOahjE. A final XOR decryption step using key 0x38, applied every 56th byte, reveals the final payload. <\/p>\n Security teams<\/a> should flag any zpaqfranz execution outside of dedicated developer or backup environments as a high-priority event.<\/a><\/p>\n After unpacking, the chain adapts to whichever antivirus product it detects on the system. If Qihoo 360 or Tencent PC Manager is found running via a WMI query, the installer switches to DLL sideloading through SodaMusicLauncher.exe \u2014 a legitimate, signed binary from ByteDance. <\/p>\n Malicious copies of powrprof.dll and wsc.dll are placed alongside it, injecting code within a trusted signed process that Chinese-market security products almost always permit. If no major antivirus is found, the payload executes directly from the C drive.<\/a><\/p>\n Security teams should block 118.107.43.65 and the broader CTG Server netblock 118.107.40.0\/21 at the network perimeter. <\/p>\n Alert on MSI installations where VBScript custom actions of type 7238 launch PowerShell, and hunt for process names GjdLUhqZIJJB.exe, SingMusice.exe, and DesignAccent.exe. <\/p>\n Treat zpaqfranz execution on standard workstations as suspicious. Monitor for AppShellElevationService registered with non-standard binary paths and watch for kernel driver load events matching the wnBios PDB signature. <\/p>\n Chinese-speaking users should exercise caution when downloading language packs or configuration files from any source outside official app channels.<\/p>\n Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n The post New Silver Fox Campaign Hides ValleyRAT Inside Fake Telegram Chinese Language Pack Installer<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\nThe Six-Stage Infection Chain<\/strong><\/h2>\n