New Silver Fox Campaign Hides ValleyRAT Inside Fake Telegram Chinese Language Pack Installer

Cybersecuritynews •Tushar Subhra Dutta • April 9, 2026

A new malware campaign linked to the Silver Fox APT group has been discovered, using a fake Telegram Chinese language pack installer to secretly deliver ValleyRAT — a powerful remote access trojan — onto targeted machines. The malicious file, disguised as a routine MSI installer, first appeared on MalwareBazaar on April 8, 2026, reported by […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silver Fox APT Campaign Distributes ValleyRAT via Fake Telegram Installer A new malware campaign linked to the Silver Fox APT group has been identified, utilizing a fake Chinese language pack installer for Telegram to deliver ValleyRAT, a sophisticated remote access trojan. The malicious MSI installer, which was uploaded to MalwareBazaar on April 8, 2026, is designed to execute a VBScript as SYSTEM immediately after extraction. This operation signifies an expansion of Silver Fox's ValleyRAT activities, indicating a targeted approach to infiltrate systems under the guise of legitimate software. The attack primarily affects users who download the compromised installer, potentially leading to unauthorized access and control over infected machines. The use of a ZPAQ-based packer adds a layer of obfuscation, complicating detection efforts. Security professionals are advised to remain vigilant against this evolving threat. Current status indicates ongoing analysis and monitoring of the campaign's impact. 2 sources 67

Extracted Entities

New Silver Fox Campaign Hides ValleyRAT Inside Fake Telegram Chinese Language Pack Installer

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Campaigns (1)

Malware (1)