New ValleyRAT Malware Targets Chinese Windows Users in Complex Multi-Stage Attack

A newly uncovered ValleyRAT campaign is specifically targeting Chinese Windows users with a sophisticated multi-stage malware attack. FortiGuard Labs reveals that this malware primarily targets sectors like e-commerce, finance, sales, and management.

The attack begins with a deceptive lure, often appearing as a legitimate document related to finance or business, and uses icons from trusted applications like Microsoft Office. Upon execution, the malware establishes itself on the system by creating a mutex and modifying registry entries, while employing various obfuscation techniques to evade detection.

via GIPHY

In the payload delivery phase, shellcode is utilized to load the malware components directly into memory, bypassing traditional file-based detection. The malware then communicates with a command-and-control (C2) server to download the core ValleyRAT payload and additional components.

According to FortiGuard Labs, the ValleyRAT malware is linked to the suspected APT group “Silver Fox,” which focuses on monitoring user activities and delivering additional plugins and malware. The malware employs numerous evasion tactics, including disabling antivirus software, modifying registry settings, and using sleep obfuscation to avoid detection.

Once installed, the core ValleyRAT payload provides attackers with extensive control over the compromised system. It enables them to monitor user activities, steal data, deploy additional malicious payloads, and execute commands such as capturing screenshots, manipulating system functions, and more.

🇨🇳 China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics

The infamous ValleyRAT malware, linked to a China-based threat actor, has resurfaced with enhanced capabilities for stealing sensitive data. The malware, first discovered in 2023, has been updated to… pic.twitter.com/qKZKm0qZtD

— SteveWalson.eth 🛡 (@Steve_Walson) June 11, 2024

The targeting of Chinese users is evident through the use of Chinese-language lures and attempts to bypass popular Chinese antivirus products. With its persistent presence and remote command execution capabilities, ValleyRAT poses a significant threat to affected systems.

This ongoing campaign highlights the importance of maintaining updated security software and exercising caution with unexpected files or links.