SilverFox Campaign Turns ValleyRAT Into Multi

Gbhackers •Mayura Kathir • July 6, 2026

The SilverFox advanced persistent threat (APT) group has escalated its offensive toolkit by transforming ValleyRAT from a conventional remote access trojan into an eight-stage malware chain culminating in a kernel-mode rootkit. This evolution marks a significant shift in post-exploitation persistence, blending user-mode orchestration with deep kernel control to evade detection and maintain long-term access. The […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SilverFox Expands ValleyRAT with Kernel-Mode Rootkit in New Campaign The SilverFox APT group has upgraded its ValleyRAT malware into a sophisticated eight-stage malware chain, culminating in a kernel-mode rootkit. This evolution enhances post-exploitation persistence and evasion techniques, making detection significantly more challenging. The malware targets corporate networks, indicating a focus on long-term access rather than immediate disruption. Security professionals are urged to be vigilant as this new strain exhibits behaviors not previously seen from SilverFox. The campaign is currently active, affecting various corporate environments, and poses a serious threat to organizational security. 2 sources 68

Extracted Entities

SilverFox Campaign Turns ValleyRAT Into Multi

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)