Hackers Hide ValleyRAT Backdoor Inside Adware Targeting Users in China and India

Hackers are using adware to deliver ValleyRAT, a Windows backdoor. The campaign primarily affects users in China and India, turning a program expected to display ads into a route for spying, theft, and further malware delivery.

The installer changes its visible behavior according to its filename. One version installs a collaboration app, another installs a browser, and a third opens a meeting-download page.

Those harmless-looking actions can keep a victim occupied while the malicious components are placed on the machine. Researchers at Securelist identified the activity after an apparent adware sample generated suspicious network traffic.

Securelist said in a report shared with Cyber Security News (CSN) that they found its advertising feature did not work at all.

Instead, it started a hidden chain that launched ValleyRAT through a modified wallpaper-management application. The scale makes the finding significant.

During 2026, researchers recorded more than 100,000 detections of ValleyRAT and related malware, affecting over 1,500 unique users, mainly in China and India. Researchers said Silver Fox is likely responsible.

Hackers Hide ValleyRAT Backdoor Inside Adware

The attack begins with an installer carrying names such as FS_SETUP_DD_173.exe or FS_SETUP_GG_173.exe. Regardless of the decoy action, it installs a tampered version of QN Wallpaper and configures it to start automatically.

The altered package abuses DLL sideloading, a Windows behavior in which a program loads a supporting file from its own folder.

QnWallpaper.exe and QnwPlayer.exe load a rogue libcef.dll, enabling attacker code to run alongside an application that appears legitimate.

A recent Silver Fox trusted software attack showed how the same technique can help malware blend into normal Windows activity.

The installer also attempts to disable Microsoft Defender using the DisableAntiSpyware registry key. The components are saved under Program Files, giving attackers a place to stage the wallpaper files and hidden backdoor components.

Once loaded, the library keeps QnWallpaper.exe active after reboot by creating a file association and placing a matching file in the Startup folder.

It checks whether the victim has administrator rights and tries to relaunch with elevated privileges when needed, increasing the damage an operator may be able to cause.

The ValleyRAT payload is encrypted and its configuration is written backwards to make inspection harder. Separate payloads use different command-and-control settings, while the backdoor can inject code into svchost to restart itself.

That persistence approach echoes a Windows backdoor memory execution case in which attackers sought to stay active without leaving obvious traces.

Data Theft and Defense

ValleyRAT is built for surveillance as well as remote control. It records keystrokes, captures clipboard contents, watches the active window, and collects host details, including Windows version, disk space, graphics hardware, local IP addresses, language settings, and idle time.

The operators can also request screenshots, clear logs, update server addresses, and download extra tools. These functions can give attackers a broad view of a compromised machine and allow them to expand their access after the initial infection.

Its defensive features add risk during incident response. Depending on the configuration, ValleyRAT can look for security and traffic-analysis applications, mark its process as critical so an attempt to terminate it may crash Windows, and automatically recover after an unhandled error.

The backdoor can download and execute modules from its control server or another attacker-controlled address. It can load malicious libraries directly or use process hollowing, which starts code inside a legitimate Windows process.

Readers following recent DLL sideloading campaigns will recognize the wider pattern: trusted-looking software is used to make a malicious launch appear less suspicious.

Organizations should keep employee cybersecurity awareness current and set clear rules for third-party software on work devices. Individuals should avoid questionable downloads and never put such programs on security-product exclusion lists.

Security teams should review autorun entries, unexpected QN Wallpaper installations, suspicious libcef.dll files beside applications, and outbound connections matching the indicators below.

They should isolate affected endpoints before cleanup, preserve evidence, reset exposed credentials where appropriate, and hunt for related activity across the network.

Earlier ValleyRAT fake installer activity illustrates why users should obtain popular software only from verified publishers. The campaign shows how a seemingly minor unwanted program can conceal a far more dangerous compromise.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC