Back Cybersecuritynews

Fake Huorong Download Site Used to Deploy ValleyRAT Backdoor in Targeted Malware Campaign

Cybersecuritynews •Tushar Subhra Dutta • February 24, 2026

A group of attackers has built a fake version of the Huorong Security antivirus website to trick users into downloading ValleyRAT, a Remote Access Trojan (RAT) built on the Winos4.0 framework. The campaign is linked to the Silver Fox APT group, a Chinese-speaking threat actor known for distributing trojanized versions of popular Chinese software. Huorong […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Huorong Site Distributes ValleyRAT Backdoor to Users A fraudulent Huorong security website has been identified as a source of the ValleyRAT backdoor, which compromises user systems. The malware campaign targets users who mistakenly visit the malicious site, which is only slightly different from the legitimate Huorong domain. This incident highlights the risks associated with typosquatting in cybersecurity. 3 sources 48

Extracted Entities

Fake Huorong Download Site Used to Deploy ValleyRAT Backdoor in Targeted Malware Campaign

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Malware (2)