ValleyRAT Detections Double in 2026 as SilverFox Expands from Chinese to Japanese Corporate Targets

ValleyRAT, a remote access trojan first identified in 2023 and historically linked to the SilverFox threat group, is experiencing a significant resurgence in 2026. Threat intelligence from LevelBlue GSOC shows that detection volumes climbed throughout 2025 and doubled in pace by early 2026, with the campaign now expanding its geographic scope from Chinese-speaking targets to Japanese-speaking corporate environments through an entirely different delivery mechanism.

The development matters for enterprise security teams globally. A threat actor adapting its tooling and its target language within a single active campaign window is not recalibrating for a new audience out of opportunism. It is testing and validating new delivery infrastructure in preparation for broader deployment. The expansion from one target language to another, while maintaining the same underlying malware, is a deliberate scaling exercise.

Two distinct attack vectors operating in parallel

LevelBlue's research documents two simultaneous attack chains, each engineered for a different target environment.

The first is a fake installer campaign that has historically targeted Chinese-speaking users and enterprises. These fake installers actively interfere with regional security software, overwriting or disabling local antivirus tools as part of the infection process. This method has been used as an initial foothold into the overseas branches of multinational corporations with offices in China, creating a bridgehead that can be used for lateral movement into the parent organisation's wider network.

The second is a newly documented phishing email campaign targeting Japanese-speaking corporate victims. These emails are written in Traditional Chinese or Japanese and are crafted to resemble urgent internal business communications covering personnel transfers, salary adjustments, or other HR topics that carry inherent urgency and authority. When a recipient clicks the embedded link, they download a ZIP archive containing two files: a legitimate, digitally signed executable and a malicious DLL.

The DLL sideloading infection chain

The phishing email explicitly instructs the recipient to open the downloaded files on a computer rather than on mobile, an instruction designed to ensure the attack executes in the Windows environment where the DLL sideloading technique will work. When the victim runs the signed executable, which is frequently disguised as VLC Media Player or another recognisable application, Windows loads the accompanying DLL as part of the application's standard startup routine.

The malicious DLL then takes over as the orchestrator of the infection. It establishes persistence by copying itself into public directories and creating registry run keys to survive reboots. It downloads the final ValleyRAT payload from a remote command and control server, using a Base64-encoded URL to obscure the download path and encrypting the payload with the RC4 algorithm using the hardcoded key "zenzensu." The final payload executes entirely in memory as a fileless implant, leaving no binary artefacts on disk that signature-based scanning would typically detect.

Why fileless execution defeats standard endpoint controls

Traditional endpoint protection relies on inspecting files written to disk and matching them against known malware signatures. A fileless implant that executes entirely in memory and never writes a payload binary to disk provides no artefact for signature-based tools to detect. LevelBlue notes that effective detection of ValleyRAT in active deployments requires proactive threat hunting rather than automated alerting, specifically monitoring for the floating module names extracted from leaked ValleyRAT source code on GitHub.

This hunting approach does generate false positives, which means it is unsuitable as a high-volume automated alert. It is, however, effective when applied by security analysts conducting structured threat hunting exercises against their endpoint telemetry.

The enterprise risk for GCC multinationals

GCC enterprises with operations across Asia, particularly those with offices or manufacturing relationships in Japan or China, carry a direct exposure to this campaign. The fake installer method specifically targets the overseas branches of multinational corporations as a bridgehead into the parent organisation's wider estate. A UAE or Saudi headquartered conglomerate with Japanese or Chinese subsidiary operations is precisely the type of organisation this campaign is engineered to exploit.

For enterprise security teams, the two most important defensive measures are user awareness training that specifically covers the pattern of urgent HR-themed emails containing file downloads, and endpoint detection configured to monitor for DLL sideloading indicators, unexpected registry run key creation from public directories, and outbound connections to newly registered or low-reputation domains over non-standard ports.

The use of digitally signed executables as the delivery vehicle is the specific reason that perimeter filtering and file reputation controls alone are insufficient against this campaign. A signed executable from a legitimate publisher will pass most gateway controls. The malicious DLL accompanying it will not be inspected independently if the gateway trusts the signed container.

The full list of confirmed indicators of compromise published by LevelBlue is below for immediate use in SIEM and threat intelligence platforms.

Indicators of compromise:

SHA1 e8be03f19ada1f5cec74b143e21d4939e781671d (malicious email attachment)
Domain frehf.oss-cn-hongkong.aliyuncs[.]com (command and control domain in malicious email)
SHA1 65168c8dd93b16d3b77092fb70c0fa6fba4dffcc (ZIP archive)

Note: domains listed in defanged format. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

The ValleyRAT resurgence follows a broader pattern of threat actors investing in capability expansion and geographic diversification in 2026. The BioShocking research documented earlier this week showed AI browser agents being conditioned to bypass security guardrails across enterprise sessions. The Sapphire Sleet npm supply chain campaign demonstrated similar geographic and technical adaptability. The consistent theme across each case is threat actors investing in evasion capability and widening their geographic aperture simultaneously.