ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions

Summary

ValleyRAT backdoor is distributed via signed adware, bypassing security by exploiting trusted processes. The malware, linked to Silver Fox, steals data and can disable antivirus. Kaspersky advises caution with untrusted software and exclusion lists.

Key Takeaways

1. The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.
2. Once installed, ValleyRAT (also tracked as Winos 4.0) hands the operator full control of the compromised machine.
3. Kaspersky also urged organizations to set clear policies on third-party software on work devices and to keep staff aware of the threat.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on a reputable cybersecurity vendor for its technical analysis and threat intelligence. It provides specific indicators of compromise and details the attack methodology. The information is presented factually, though it lacks direct victim accounts for this specific campaign.

Bias assessment: Technical Security Reporting. The article focuses on technical details of a cyber threat, reporting findings from a cybersecurity firm. The language is objective and informative, aiming to educate readers about a specific malware campaign without adopting a particular political or social stance.

Note: This article provides a technical breakdown of a cyber threat. While based on expert analysis, it focuses on the 'how' of the attack rather than broader implications or verified victim impact.

Credibility flag: Technical Analysis

Claimed Facts (7)

• This states a factual observation about the disguise used by the attackers, attributed to a specific vendor.
• This is a technical explanation of the method used for the attack, presented as a factual mechanism.
• This describes specific technical actions taken by the malware during installation, presented as factual steps.
• This details a specific behavior of the malware to gain necessary privileges, presented as a factual process.
• This describes a specific defensive mechanism employed by the malware, presented as a factual capability.
• These are specific technical identifiers (hashes) provided as evidence of the malware, presented as factual data.
• These are specific network addresses and ports associated with the malware's communication, presented as factual indicators.

Opinions (4)

• This is an interpretive statement by Kaspersky, expressing a viewpoint on the implications of the observed attack.
• While descriptive, the term 'sophisticated' introduces a subjective assessment of the malware's design and capability.
• The attribution to 'Silver Fox' is presented as a likely conclusion based on evidence, but still involves an element of interpretation and inference.
• This is a direct recommendation and piece of advice from Kaspersky, reflecting their expert opinion on user behavior.

Claims (5)

• While The Hacker News is a source, its inclusion as a 'source' in the context of a specific claim made by Kaspersky is redundant and doesn't add to the analysis of the claim itself.
• This is a factual statement about Facebook, but it is irrelevant to the cybersecurity analysis presented in the article and appears as an author attribution without context.
• This is a redundant statement about the source itself, not a claim made within the article's narrative.
• This is a redundant statement about the source itself, not a claim made within the article's narrative.
• This is a redundant statement about the source itself, not a claim made within the article's narrative.

Key Sources

• Kaspersky — Cybersecurity Vendor
• The Hacker News — Media Outlet