Silver Fox APT Distributes ValleyRAT via Typosquatted Telegram Download Portals — Threadlinqs Intelligence
As of 2026-05-30, Silver Fox APT Distributes ValleyRAT via Typosquatted Telegram Download Portals is a high-severity malware threat attributed to Void Arachne (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0239 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: Void Arachne · China · ESPIONAGE
The Silver Fox APT group is distributing ValleyRAT malware through typosquatted Telegram download websites (telegrgam.com, telefgram.com, tejlegram.com). The campaign uses a multi-stage loader that
A malware distribution campaign attributed to Silver Fox APT (also tracked as Void Arachne, SwimSnake, Great Thief of the Valley, and UTG-Q-1000) leverages typosquatted domains impersonating the official Telegram download portal to deliver ValleyRAT, a multi-stage remote access trojan.
The attack begins when victims visit one of three typosquatted domains — telegrgam.com, telefgram.com, or tejlegram.com — which closely mimic the legitimate Telegram website. These sites serve a malicious installer named tsetup-x64.6.exe, disguised as a legitimate Telegram Desktop setup package.
Upon execution, the installer performs initial reconnaissance by running tasklist to check for security products (notably 360Tray.exe, associated with 360 Total Security). It then launches obfuscated PowerShell commands to disable Windows Defender by adding drive exclusions for C:\, D:\, E:\, and F:\ partitions using Add-MpPreference -ExclusionPath. The installer creates a registry marker at HKCU\Microsoft User\Source as an infection identifier.
The malware stages its payload components in the AppData\Roaming\Embarcadero directory, dropping AutoRecoverDat.dll (the loader DLL), GPUCache.xml (containing the XML-encoded PE payload), and telegrom.exe (a legitimate Telegram executable dropped to maintain the appearance of a genuine installation).
The core loading mechanism uses Binary Proxy Execution via rundll32.exe, invoking the DllRegisterServer export function of AutoRecoverDat.dll. This DLL reads the GPUCache.xml file, which contains encoded binary data representing a portable executable. The loader performs reflective code loading — reconstructing the PE in memory, resolving imports, adjusting base relocations, and transferring execution without writing the final payload to disk.
Once the reflectively-loaded payload executes within the rundll32.exe process context, it establishes a TCP connection to the command-and-control server at 27.50.59.77 on port 18852, with the associated domain jiijua.com. The C2 communication enables remote command execution, payload updates, and persistent control of the compromised system.
This campaign shares significant infrastructure and tactical overlap with previous Silver Fox operations. The identical loading chain (AutoRecoverDat.dll + GPUCache.xml + DllRegisterServer + rundll32.exe + port 18852) was previously observed in a November 2025 Silver Fox campaign impersonating Microsoft Teams via the domain teamscn.com, which delivered the same ValleyRAT variant. Silver Fox has historically operated fake Telegram download sites, with at least 20 related domains identified in March 2025 campaigns. The group has also been linked to campaigns targeting healthcare, government, education, and financial sectors across Asia-Pacific, Europe, and North America.
ValleyRAT is a multi-stage, multi-component remote access trojan first identified in early 2023, primarily targeting Chinese-speaking users. It enables attackers to remotely control infected systems, exfiltrate data, execute arbitrary commands, deploy additional plugins, and maintain long-term persistence. Silver Fox operates with dual objectives of espionage/intelligence collection and financial gain, maintaining plausible deniability from direct state sponsorship while consistently leveraging Chinese-language infrastructure.
Target sectors: government, healthcare, education, financial, technology, gaming, cybersecurity
Target regions: Asia-Pacific, China, Taiwan, India, Europe, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1059.003, T1059.001, T1204.002, T1112, T1562.001, T1027, T1027.011, T1218.011, T1620