You know those download sites that look legit but something feels off? Turns out, that's exactly what a new malware campaign is banking on. Attackers are setting up fake software download pages that look almost identical to the real thing. And they're using them to infect people with ValleyRAT.

Microsoft spotted the campaign. The attackers are going after Chinese-speaking users who think they're downloading popular software. The campaign has already hit healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.

Here's what's going on.

Quick Summary

The Fake Download Websites

The attackers have created copycat websites which resemble the genuine sites. They replicated their design, branding and layout as well. They feature a big "download" button that's hard to miss.

The Domains to Watch:

The sites are hosted on .com.cn and .hl.cn domains. Here are some of the fake ones they've spotted:

• app-microsoft-edge[.]com[.]cn
• baidu-pan[.]com[.]cn
• calibre-ebook[.]com[.]cn
• cn-drawio[.]com[.]cn
• gw-sogou[.]com[.]cn
• kaspersky-lab[.]hl[.]cn
• mindmoster[.]com[.]cn
• ocam-pc[.]com[.]cn
• pc-razerzone[.]com[.]cn
• sejda[.]hl[.]cn
• steelseries-cn[.]com[.]cn
• translate-youdao[.]hl[.]cn
• zh-diskgenius[.]com[.]cn

The Payload:

Here's the sneaky part. The downloaded archive keeps the same file name, but the hash changes every time. That means the payload is generated fresh for every single download. Every victim is provided with an individual file, which makes detection difficult.

How the Infection Works

Step 1: The Wrapper Installer

You open the archive and run the installer. It's usually named something like "a_instapp83353001.exe" or "ainst8663586104.exe." Clicking it triggers the first stage of the malware.

Step 2: Alternative Execution Method

Microsoft also found another way the attackers do this. They use the trusted Windows Installer service ("msiexec.exe") to launch a random executable. Same trick, different method.

Step 3: Staying Put

The malware creates scheduled tasks that look like routine IT jobs. It also:

• Creates a scheduled task running as SYSTEM
• Adds exclusions to Microsoft Defender via PowerShell
• Deletes volume shadow copies so you can't restore
• Locks down payload directories using icacls so you can't delete them

Step 4: Messing with Windows Update

The malware stops and disables key Windows Update services. It even renames update DLLs and deletes the SoftwareDistribution cache. Basically, it tries to break your ability to get security updates.

Step 5: Calling Home

Once everything is set up, the malware connects back to its command-and-control servers. It uses non-standard ports like 5090, 7031, 7032, 7088–7090, 8050, 28290, and 28300.

C2 Domains:

• iualef[.]net
• oijfwe[.]net

What ValleyRAT Actually Does

ValleyRAT is a powerful backdoor. It can do a lot of damage:

• Collect system information
• Reboot or shut down your computer
• Take screenshots
• Wipe logs to cover its tracks
• Update C2 addresses
• Download more malware modules
• Record keystrokes and clipboard data

The Keylogger:

It captures everything you type and everything you copy. It saves it to a file on disk. It also scans for windows belonging to analysis tools, so it knows if you're trying to investigate it.

Who's Behind This?

Microsoft says with moderate confidence that this is Silver Fox (aka Yinhu). The group has done this before using fake download pages to spread Gh0st RAT and ValleyRAT.

The Kaspersky Connection:

Just days earlier, Kaspersky detailed a similar campaign. Silver Fox used a modified Chinese desktop wallpaper app called QN Wallpaper to deliver ValleyRAT through DLL sideloading.

The GoldenEyeDog Connection:

ValleyRAT has also been linked to a subgroup of GoldenEyeDog called CuboidalCanine. They've moved away from Gh0st RAT and now use ValleyRAT. They target the gambling industry and use watering holes to spread the malware.

What Expel Said:

"This malware isn't unique to any actor, but has been known to be used by GoldenEyeDog. Due to the source code being public, attribution of this malware to any actor relies on factors other than the malware family itself."

What Microsoft Did

Microsoft's Defender caught the campaign and triggered automated containment procedures. That limited the damage. But it's still unclear what the attackers' end goal was.

What Actions to Take

1. Verify Where You're Downloading From

Only download software from official vendor sites. Check the URL. Look for typos.

2. Check the Domain

Legitimate vendors don't use .com.cn or .hl.cn for main downloads. Be suspicious.

3. Scan Before You Open

Run every downloaded file through security software. Even if the name looks right, the hash changes with every download.

4. Defender Exclusion Checks

Check whether there are any surprises within the list of Defender exclusions. They can usually be set using PowerShell.

5. Malicious Scheduled Tasks

There may be some scheduled tasks that look like legitimate work that an IT person would do, but aren’t.

The Bottom Line

Silver Fox is using fake download sites to spread ValleyRAT. The attackers are targeting Chinese-speaking users across multiple sectors. The malware breaks Defender, disables updates, and steals your data.

What You Need to Know:

What You Need to Do:

• Source verification of downloaded files
• Verification of domain
• Scanning of files prior to use
• Defender exclusions watch
• Scheduled tasks observation

FAQ Section

What is the Silver Fox bogus download sites campaign?

Silver Fox is using fake software download sites to distribute ValleyRAT. The sites impersonate trusted vendors and target Chinese-speaking users.

How does the attack work?

The user goes to a fake downloading site, downloads a file, and executes an installer. The malware then persists on the system, stops Defender from functioning, and sends commands to C2 servers.

What sectors are being targeted?

Healthcare, manufacturing, gaming, technology, logistics, government, and education sectors have been hit.

Who is behind this?

Microsoft assessed with moderate confidence that the campaign is consistent with Silver Fox. ValleyRAT has also been attributed to GoldenEyeDog's CuboidalCanine sub-group.

What should I do?

Verify download sources, check domains carefully, scan files before opening, monitor Defender exclusions, and watch for unusual scheduled tasks.

Source: The Hacker News