Cybersecurity researchers have uncovered a stealth operation delivering the ValleyRAT backdoor to Windows PCs across China and India by disguising it inside adware. What appears as ad-supported wallpaper software is actually being used for spying, malware delivery, and persistent control. The campaign was brought to light after unusual network activity was tied back to what should have been simple adware.
How the Attack Operates
The threat begins with fake setup files—variants like FS_SETUP_DD_173.exe, FS_SETUP_GG_173.exe, or FS_SETUP_HY_173.exe—which claim to install things like a collaboration app, a browser, or a meeting-download launcher. All versions install a tampered wallpaper-management app called QN Wallpaper designed to run automatically on system startup.
The attackers employ DLL sideloading—an exploit where the legitimate applications QnWallpaper.exe and QnwPlayer.exe are made to load a malicious libcef.dll from their own folder. This gives the attackers a stealthy way to run malicious code while hiding behind legitimate processes. The installer also tries to disable Microsoft Defender via registry changes and places the malware components under Program Files for persistence.
To stay active even after reboot, the modified QN Wallpaper app creates startup folder entries and file associations to relaunch itself. It detects whether the current user has administrator rights and, if needed, escalates privileges. The ValleyRAT payload is encrypted and obfuscated—configurations are written backwards—and in some attacks, the backdoor even injects into svchost.exe so it can restart itself if terminated.
What ValleyRAT Does & How to Spot It
ValleyRAT gives full remote-control and surveillance capabilities. It logs keystrokes, grabs clipboard content, monitors active windows, takes screenshots, and gathers system info including disk space, graphics hardware, local IP addresses, language settings, and idle time. Operators can issue commands for additional modules, log clearing, server updates, and more. Defensive mechanisms are also part of its design: it can hunt for security tools, mark its process as critical (so stopping it may crash Windows), and auto-recover from errors to avoid detection.
The scale of this campaign is significant. In 2026 alone, over 100,000 detections related to ValleyRAT and its malware were observed, impacting more than 1,500 unique users—mostly within China and India. The group likely behind this attack is known as Silver Fox. Indicators of compromise include specific filenames, malicious DLLs like libcef.dll, installer variants, encrypted payload files, and known command-and-control IPs.
Organizations responding to potential infections should audit startup programs and autorun entries. Be alert for unexpected QN Wallpaper installations, suspicious DLLs sitting beside legitimate apps, and outbound network traffic to known endpoints. Once a threat is confirmed, isolate infected systems before cleanup, preserve forensic evidence, reset breached credentials when necessary, and hunt broadly across the network for related signs of compromise.
This campaign underscores how adware-like programs can serve as Trojan horses for far more dangerous attacks. Obtaining software only from verified publishers and exercising caution with third-party apps remain essential defenses.
Why it matters: ValleyRAT’s ability to blend into seemingly benign adware routines makes detection especially difficult for both individuals and enterprises. In environments with weak endpoint security, this kind of attack could allow long-term data collection or lateral movement without raising alarms.
