Silver Fox APT Distributes ValleyRAT via Typosquatted Telegram Download Portals
Silver Fox APT Distributes ValleyRAT via Typosquatted (TL-2026-0239), also tracked as Fake Telegram Campaign, is a high-severity malware campaign, first published 2026-03-17. It is attributed to Void Arachne (China) with high confidence, affects Microsoft Windows, maps to 19 MITRE ATT&CK techniques (T1027, T1027.011, T1036.005), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0239
- Threat ID
- TL-2026-0239
- Also known as
- Fake Telegram Campaign, ValleyRAT Telegram Loader
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-03-17
- Last reviewed
- 2026-03-17
- Attribution
- Void Arachne
- Attribution confidence
- HIGH
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government, healthcare, education, financial, technology, gaming, cybersecurity
- Target regions
- Asia-Pacific, China, Taiwan, India, Europe, North America
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Silver Fox APT Distributes ValleyRAT via Typosquatted
Malware and tooling: ValleyRAT
The Silver Fox APT group is distributing ValleyRAT malware through typosquatted Telegram download websites (telegrgam.com, telefgram.com, tejlegram.com). The campaign uses a multi-stage loader that drops a malicious DLL sideloaded via rundll32, reads an XML-encoded reflective payload, and establishes C2 communication to 27.50.59.77:18852 and jiijua.com.
How Silver Fox APT Distributes ValleyRAT via Typosquatted works
A malware distribution campaign attributed to Silver Fox APT (also tracked as Void Arachne, SwimSnake, Great Thief of the Valley, and UTG-Q-1000) leverages typosquatted domains impersonating the official Telegram download portal to deliver ValleyRAT, a multi-stage remote access trojan.
The attack begins when victims visit one of three typosquatted domains — telegrgam.com, telefgram.com, or tejlegram.com — which closely mimic the legitimate Telegram website. These sites serve a malicious installer named tsetup-x64.6.exe, disguised as a legitimate Telegram Desktop setup package.
Upon execution, the installer performs initial reconnaissance by running tasklist to check for security products (notably 360Tray.exe, associated with 360 Total Security). It then launches obfuscated PowerShell commands to disable Windows Defender by adding drive exclusions for C:\, D:\, E:\, and F:\ partitions using Add-MpPreference -ExclusionPath. The installer creates a registry marker at HKCU\Microsoft User\Source as an infection identifier.
The malware stages its payload components in the AppData\Roaming\Embarcadero directory, dropping AutoRecoverDat.dll (the loader DLL), GPUCache.xml (containing the XML-encoded PE payload), and telegrom.exe (a legitimate Telegram executable dropped to maintain the appearance of a genuine installation).
The core loading mechanism uses Binary Proxy Execution via rundll32.exe, invoking the DllRegisterServer export function of AutoRecoverDat.dll. This DLL reads the GPUCache.xml file, which contains encoded binary data representing a portable executable. The loader performs reflective code loading — reconstructing the PE in memory, resolving imports, adjusting base relocations, and transferring execution without writing the final payload to disk.
Once the reflectively-loaded payload executes within the rundll32.exe process context, it establishes a TCP connection to the command-and-control server at 27.50.59.77 on port 18852, with the associated domain jiijua.com. The C2 communication enables remote command execution, payload updates, and persistent control of the compromised system.
This campaign shares significant infrastructure and tactical overlap with previous Silver Fox operations. The identical loading chain (AutoRecoverDat.dll + GPUCache.xml + DllRegisterServer + rundll32.exe + port 18852) was previously observed in a November 2025 Silver Fox campaign impersonating Microsoft Teams via the domain teamscn.com, which delivered the same ValleyRAT variant. Silver Fox has historically operated fake Telegram download sites, with at least 20 related domains identified in March 2025 campaigns. The group has also been linked to campaigns targeting healthcare, government, education, and financial sectors across Asia-Pacific, Europe, and North America.
ValleyRAT is a multi-stage, multi-component remote access trojan first identified in early 2023, primarily targeting Chinese-speaking users. It enables attackers to remotely control infected systems, exfiltrate data, execute arbitrary commands, deploy additional plugins, and maintain long-term persistence. Silver Fox operates with dual objectives of espionage/intelligence collection and financial gain, maintaining plausible deniability from direct state sponsorship while consistently leveraging Chinese-language infrastructure.
MITRE ATT&CK techniques used in TL-2026-0239
defense-evasion
T1027 Obfuscated Files or Information; T1027.011 Fileless Storage; T1036.005 Match Legitimate Resource Name or Location; T1112 Modify Registry; T1140 Deobfuscate/Decode Files or Information; T1218.011 Rundll32; T1620 Reflective Code Loading
discovery
T1057 Process Discovery; T1518.001 Security Software Discovery
execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
initial-access
resource-development
T1583.001 Domains; T1608.001 Upload Malware
defense-impairment
Affected products and versions in Silver Fox APT Distributes ValleyRAT via Typosquatted
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022
Remediation for Silver Fox APT Distributes ValleyRAT via Typosquatted
Immediate actions
- Block typosquatted domains telegrgam.com, telefgram.com, tejlegram.com, and jiijua.com at DNS and proxy level
- Block outbound connections to 27.50.59.77 on all ports, especially TCP 18852
- Search for AutoRecoverDat.dll, GPUCache.xml, and telegrom.exe in AppData\Roaming\Embarcadero on all endpoints
- Hunt for rundll32.exe processes loading DllRegisterServer with non-standard DLLs
- Review Windows Defender exclusion policies for unauthorized drive-wide exclusions
Workarounds
- Block execution of DLLs from AppData\Roaming directories via AppLocker or WDAC policies
- Restrict rundll32.exe execution to authorized DLLs only
- Educate users to download Telegram exclusively from telegram.org
Longer-term hardening
- Deploy EDR solutions with behavioral detection for reflective code loading and DLL sideloading via rundll32
- Implement DNS filtering to block newly registered and typosquatted domains
- Enable PowerShell script block logging and constrained language mode to detect Defender tampering
- Monitor for registry modifications under HKCU\Microsoft User\Source
- Implement application whitelisting to prevent execution of unsigned binaries from user-writable directories
Timeline of Silver Fox APT Distributes ValleyRAT via Typosquatted
- ValleyRAT first identified in the wild, primarily targeting Chinese-speaking users through phishing campaigns
- Silver Fox operates at least 20 fake Telegram download domains identified by researchers, establishing pattern of Telegram impersonation
- Silver Fox leverages SEO poisoning to distribute backdoor installers of at least 20 widely used applications, expanding beyond Telegram
- Silver Fox launches fake Microsoft Teams campaign via teamscn.com using identical loader chain (AutoRecoverDat.dll + GPUCache.xml + port 18852)
- Detailed multi-stage loader analysis published by K7 Labs researcher Praveen Babu, documenting full kill chain from typosquatted site to C2 establishment
- C2 infrastructure at 27.50.59.77:18852 and domain jiijua.com confirmed active, receiving connections from compromised systems
- K7 Labs publishes analysis of fake Telegram malware campaign using typosquatted domains telegrgam.com, telefgram.com, and tejlegram.com distributing ValleyRAT
- As of 2026-05-29, the threat remains active: Silver Fox APT keeps deploying ValleyRAT through April-May 2026 (fake Telegram Chinese language-pack MSI on MalwareBazaar 4/8, tax-themed RustSL/ABCDoor waves), and no source reports disruption or sinkholing of this no-CVE malware campaign. This specific typosquatted-Telegram variant (jiijua.com, 27.50.59.77:18852) is documented and contained but superseded by the same actor's newer lures, warranting MONITORING.
Sources cited for Silver Fox APT Distributes ValleyRAT via Typosquatted
- K7 Labs - Fake Telegram Malware Campaign: Analysis of a Multi-Stage Loader Delivered via Typosquatted Websites
- ReliaQuest - Silver Fox Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack
- The Hacker News - Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China
- Trustwave SpiderLabs - Inside Silver Fox Den: Unmasks a Global Threat Actor
- Splunk - ValleyRAT Insights: Tactics, Techniques, and Detection Methods
- Fortinet FortiGuard Labs - A Deep Dive into a New ValleyRAT Campaign Targeting Chinese Speakers
- Joe Sandbox - Automated Malware Analysis Report for AutoRecoverDat.dll
- Picus Security - Silver Fox APT Targets Public Sector via Trojanized Medical Software
- MITRE ATT&CK - Reflective Code Loading T1620
- Splunk - Suspicious Rundll32 DllRegisterServer Detection
Threats related to Silver Fox APT Distributes ValleyRAT via Typosquatted
- Silver Fox APT Tax-Themed Phishing Campaigns Deploying ValleyRAT, BYOVD Driver Abuse, and Kernel Rootkits
- Silver Fox APT Tax-Themed Phishing — RustSL Loader, ValleyRAT & New ABCDoor Python Backdoor
- ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence
Detection coverage for TL-2026-0239
As of 2026-03-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0239 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.