Breakglass Intelligence

Two ValleyRAT samples surfaced on MalwareBazaar within days of each other. Both target Chinese-speaking users through trojanized software. Both belong to the same campaign family — but their infrastructure tells two very different stories.

The first sample, malware64.dll , is a KCP-based C2 communication module that phones to 103.215.77[.]17:4488 in Hong Kong. The hosting provider is LANLIAN INTERNATIONAL HOLDING GROUP LIMITED. The abuse is a Gmail address. The server has WinRM (port 5985) open to the internet. VirusTotal shows 78+ related malware samples communicating with this same IP. The C2 is live as of this writing.

The second sample is a Rust-compiled loader disguised as "Microsoft OneDrive Sync Engine." It runs multi-layer sandbox evasion, decrypts an embedded payload with AES-256-CBC, and drops a full ValleyRAT core DLL. Its C2 address is not an IP or a throwaway domain — it is v52-83fbf297.govroam.cf.ac.uk , a hostname on Cardiff University's GovRoam network. The hostname pattern suggests a VPN-authenticated or 802.1x-enrolled device — likely a compromised researcher or student laptop that was repurposed as a C2 relay. Those ports are now closed, suggesting the device was cleaned or disconnected from the network.

The convergence of a live Hong Kong C2 with a compromised British university endpoint illustrates how Chinese APT groups layer disposable academic infrastructure on top of persistent commercial hosting.

If any of this overlaps with your prior work — particularly the Cardiff GovRoam relay or this specific LANLIAN-hosted C2 — please reach out. We will update this post and credit the earlier source.

This DLL is a C2 communication module. It implements the KCP protocol — a reliable, low-latency transport layer built on UDP, popular in Chinese gaming and tunneling software and increasingly adopted by Chinese malware authors for its NAT-traversal properties and lower visibility compared to TCP.

The C2 address is stored as a reversed wide string in the .rdata section. Flipping it yields the connection target: 103.215.77[.]17 on port 4488 .

The most telling artifact is the parent module import name: 上线模块.dll — literally "Online Module DLL" in Chinese. This is a hallmark of ValleyRAT and its associated loader ecosystem. The Chinese-language internal naming is consistent across ValleyRAT tooling and reflects the operational language of the development team.

The C2 at 103.215.77[.]17 is allocated to LANLIAN INTERNATIONAL HOLDING GROUP LIMITED (Hong Kong). Shodan confirms port 5985 (WinRM) is open. The abuse is Kchan2789@gmail[.]com — a Gmail address, not a hosting abuse desk. VirusTotal shows 78+ malware samples communicating with this IP across multiple campaigns. The C2 is live as of this investigation.

The Rust loader is the more technically interesting of the two samples. A 263KB executable with the PDB path loader.pdb , compiled with Rust and presenting itself as Microsoft's OneDrive synchronization engine. It carries an encrypted stage-2 payload in its .rdata section — 107KB of data at entropy 7.671, effectively indistinguishable from random without the key.

This is the finding that prompted this writeup.

The stage-2 ValleyRAT core DLL does not connect to a bulletproof hoster in Hong Kong or a disposable VPS. Its C2 address is:

Let's break that down:

DNS resolution confirms this hostname resolves (or resolved) to 131.251.242.151, which falls within Cardiff University's allocated IP space.

A device on Cardiff's GovRoam network was compromised and repurposed as a C2 relay. A researcher, student, or government visitor's device — already compromised or infected on-network — was configured as a relay, exploiting the university's clean IP reputation. The device has since disconnected or been remediated; all three C2 ports are now closed.

Academic networks are attractive for C2 relay: university IP ranges are broadly allowlisted, GovRoam/eduroam endpoints cycle frequently making attribution difficult, and network monitoring tends to focus on bandwidth abuse rather than C2 beaconing. The choice of three fallback ports (8044, 9044, 98) suggests the operators anticipated intermittent connectivity — exactly what you'd expect from a relay that depends on a user's laptop being powered on and connected to campus WiFi.

Unlike the ephemeral Cardiff relay, this Hong Kong IP is persistent infrastructure. Seventy-eight or more samples have phoned to it across months of activity. The abuse is a personal Gmail address rather than a hosting provider's abuse desk — suggesting either a small operation with limited abuse response, or an actor-controlled registration. Port 5985 (WinRM) confirms this is a Windows host with remote management exposed to the internet.

The Rust loader runs a multi-layer environment check before decrypting its payload. If any check triggers, execution terminates silently — no crash, no error message, no artifacts. The checks include:

If any check triggers, execution terminates silently. The Rust compilation adds an additional layer of difficulty — Rust binaries are notoriously tedious to reverse-engineer due to complex control flow graphs from the ownership model, monomorphized generics, and panic-handling boilerplate.

The encrypted stage-2 lives in the Rust loader's .rdata section as a 107KB blob. The entropy of 7.671 (out of a maximum 8.0) confirms it is encrypted or compressed data — in this case, AES-256-CBC encrypted.

After passing all sandbox checks, the loader derives the AES-256 key and IV from hardcoded values, decrypts the .rdata blob, maps the resulting PE into memory, and transfers execution. The decrypted output is a 107KB MSVC C++ DLL — the ValleyRAT core.

The core DLL contains RTTI class names consistent with ValleyRAT: CKernelManager (command dispatch, persistence, module management) and CTcpSocket (C2 communication). Chinese characters in the C2 configuration reinforce attribution to a Chinese-speaking actor.

The campaign ID x9y8z7w6v5u4t3s2r1q0p9o8n7m6l5k4 is a sequential alphanumeric pattern — potentially a placeholder or internal campaign tag. Three fallback ports (8044, 9044, 98) on the same hostname provide redundancy. Port 98 falls in the well-known range and could blend with legitimate traffic on a university network.

These two samples are linked by more than malware family classification:

The infrastructure strategy is deliberate: persistent Hong Kong commercial hosting as the backbone, ephemeral academic relays as disposable frontends. When the Cardiff relay goes down, the campaign's core infrastructure remains intact.

ValleyRAT (also tracked as Farfli, Winos, PoisonMouse) targets Chinese-speaking users through trojanized software. The KCP protocol in Sample 1 reflects a broader trend — KCP adoption in Chinese malware has increased since 2025 for its NAT-traversal and low-latency properties.

For Cardiff University / Jisc:

For network defenders:

For threat intelligence teams:

Both samples were sourced from abuse.ch MalwareBazaar , which continues to be an indispensable resource for the threat intelligence community. The researchers and submitters who contribute samples to MalwareBazaar make work like this possible.

ValleyRAT has been extensively documented by researchers at Fortinet, Zscaler, Proofpoint, and others. This report builds on their foundational work in tracking this malware family and its Chinese APT operators.

If you have additional context on these samples, the Cardiff GovRoam relay, or the LANLIAN hosting infrastructure — or if we've missed prior art — reach out via DM on X or at [email protected] . We will update this post with proper credit.

Tags: ValleyRAT, Farfli, Winos, Chinese APT, Cardiff University, GovRoam, KCP Protocol, Rust Malware, AES-256-CBC, Hong Kong C2, Academic Infrastructure Compromise