Silver Fox Campaign Spreads ValleyRAT via Fake Chinese Telegram Language Pack

Gbhackers •Mayura Kathir • April 9, 2026

New analysis of a fake Telegram installer uploaded to MalwareBazaar shows Silver Fox expanding its ValleyRAT operations with a fresh delivery chain that hides behind a Chinese-language pack-decoy and an uncommon ZPAQ-based packer. The MSI is a WiX-built installer (IssueAccentRequest, 4.49 MB) that runs a VBScript custom action as SYSTEM immediately after file extraction, while […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Silver Fox APT Campaign Distributes ValleyRAT via Fake Telegram Installer A new malware campaign linked to the Silver Fox APT group has been identified, utilizing a fake Chinese language pack installer for Telegram to deliver ValleyRAT, a sophisticated remote access trojan. The malicious MSI installer, which was uploaded to MalwareBazaar on April 8, 2026, is designed to execute a VBScript as SYSTEM immediately after extraction. This operation signifies an expansion of Silver Fox's ValleyRAT activities, indicating a targeted approach to infiltrate systems under the guise of legitimate software. The attack primarily affects users who download the compromised installer, potentially leading to unauthorized access and control over infected machines. The use of a ZPAQ-based packer adds a layer of obfuscation, complicating detection efforts. Security professionals are advised to remain vigilant against this evolving threat. Current status indicates ongoing analysis and monitoring of the campaign's impact. 2 sources 67

Extracted Entities

Silver Fox Campaign Spreads ValleyRAT via Fake Chinese Telegram Language Pack

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (2)

Tools (1)