Skip to content
ThreatCluster

Silver Fox APT Deploys ValleyRAT via Fake Installers Targeting China

First seen 5 Dec 2025, 02:43 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

The Silver Fox APT group has launched a campaign targeting users in China by distributing malware through fake installers of popular applications, including Microsoft Teams. The malware, known as ValleyRAT, employs advanced evasion techniques to compromise systems and maintain persistent access. This operation showcases sophisticated methods such as kernel-level driver abuse and multi-stage obfuscation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 217d ago How this analysis works

More articles in this cluster (2)

Following this threat?

Track Cozy Bear and Oyster backdoor in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed