SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in Live ValleyRAT Campaign

Cybersecuritynews •Tushar Subhra Dutta • July 6, 2026

A new strain of remote access malware is quietly moving through corporate networks, and it does not behave like anything defenders have seen from this threat group before. The malware, tracked as ValleyRAT, is deployed by a hacking group known as SilverFox, and it stands out for one reason: it refuses to stop at just […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SilverFox Expands ValleyRAT with Kernel-Mode Rootkit in New Campaign The SilverFox APT group has upgraded its ValleyRAT malware into a sophisticated eight-stage malware chain, culminating in a kernel-mode rootkit. This evolution enhances post-exploitation persistence and evasion techniques, making detection significantly more challenging. The malware targets corporate networks, indicating a focus on long-term access rather than immediate disruption. Security professionals are urged to be vigilant as this new strain exhibits behaviors not previously seen from SilverFox. The campaign is currently active, affecting various corporate environments, and poses a serious threat to organizational security. 2 sources 68

Extracted Entities

SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in Live ValleyRAT Campaign

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (2)

Tools (1)