# Silver Fox APT Distributes ValleyRAT via Typosquatted Telegram Download Portals

> The Silver Fox APT group is distributing ValleyRAT malware through typosquatted Telegram download websites (telegrgam.com, telefgram.com, tejlegram.com). The campaign uses a multi-stage loader that drops a malicious DLL sideloaded via rundll32, reads an XML-encoded reflective payload, and establishes C2 communication to 27.50.59.77:18852 and jiijua.com.

- **Published:** 2026-03-17T12:00:00Z
- **Last reviewed:** 2026-03-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0239
- **ID:** TL-2026-0239
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** Void Arachne (China)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A malware distribution campaign attributed to Silver Fox APT (also tracked as Void Arachne, SwimSnake, Great Thief of the Valley, and UTG-Q-1000) leverages typosquatted domains impersonating the official Telegram download portal to deliver ValleyRAT, a multi-stage remote access trojan.

The attack begins when victims visit one of three typosquatted domains — telegrgam.com, telefgram.com, or tejlegram.com — which closely mimic the legitimate Telegram website. These sites serve a malicious installer named tsetup-x64.6.exe, disguised as a legitimate Telegram Desktop setup package.

Upon execution, the installer performs initial reconnaissance by running tasklist to check for security products (notably 360Tray.exe, associated with 360 Total Security). It then launches obfuscated PowerShell commands to disable Windows Defender by adding drive exclusions for C:\, D:\, E:\, and F:\ partitions using Add-MpPreference -ExclusionPath. The installer creates a registry marker at HKCU\Microsoft User\Source as an infection identifier.

The malware stages its payload components in the AppData\Roaming\Embarcadero directory, dropping AutoRecoverDat.dll (the loader DLL), GPUCache.xml (containing the XML-encoded PE payload), and telegrom.exe (a legitimate Telegram executable dropped to maintain the appearance of a genuine installation).

The core loading mechanism uses Binary Proxy Execution via rundll32.exe, invoking the DllRegisterServer export function of AutoRecoverDat.dll. This DLL reads the GPUCache.xml file, which contains encoded binary data representing a portable executable. The loader performs reflective code loading — reconstructing the PE in memory, resolving imports, adjusting base relocations, and transferring execution without writing the final payload to disk.

Once the reflectively-loaded payload executes within the rundll32.exe process context, it establishes a TCP connection to the command-and-control server at 27.50.59.77 on port 18852, with the associated domain jiijua.com. The C2 communication enables remote command execution, payload updates, and persistent control of the compromised system.

This campaign shares significant infrastructure and tactical overlap with previous Silver Fox operations. The identical loading chain (AutoRecoverDat.dll + GPUCache.xml + DllRegisterServer + rundll32.exe + port 18852) was previously observed in a November 2025 Silver Fox campaign impersonating Microsoft Teams via the domain teamscn.com, which delivered the same ValleyRAT variant. Silver Fox has historically operated fake Telegram download sites, with at least 20 related domains identified in March 2025 campaigns. The group has also been linked to campaigns targeting healthcare, government, education, and financial sectors across Asia-Pacific, Europe, and North America.

ValleyRAT is a multi-stage, multi-component remote access trojan first identified in early 2023, primarily targeting Chinese-speaking users. It enables attackers to remotely control infected systems, exfiltrate data, execute arbitrary commands, deploy additional plugins, and maintain long-term persistence. Silver Fox operates with dual objectives of espionage/intelligence collection and financial gain, maintaining plausible deniability from direct state sponsorship while consistently leveraging Chinese-language infrastructure.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1027.011 Fileless Storage
- T1218.011 Rundll32
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1057 Process Discovery
- T1518.001 Security Software Discovery
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1583.001 Domains
- T1608.001 Upload Malware

## Sources

- [K7 Labs - Fake Telegram Malware Campaign: Analysis of a Multi-Stage Loader Delivered via Typosquatted Websites](https://labs.k7computing.com/index.php/fake-telegram-malware-campaign-analysis-of-a-multi-stage-loader-delivered-via-typosquatted-websites/)
- [ReliaQuest - Silver Fox Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack](https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/)
- [The Hacker News - Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China](https://thehackernews.com/2025/12/silver-fox-uses-fake-microsoft-teams.html)
- [Trustwave SpiderLabs - Inside Silver Fox Den: Unmasks a Global Threat Actor](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/inside-silver-foxs-den-trustwave-spiderlabs-unmasks-a-global-threat-actor/)
- [Splunk - ValleyRAT Insights: Tactics, Techniques, and Detection Methods](https://www.splunk.com/en_us/blog/security/valleyrat-insights-tactics-techniques-and-detection-methods.html)
- [Fortinet FortiGuard Labs - A Deep Dive into a New ValleyRAT Campaign Targeting Chinese Speakers](https://www.fortinet.com/blog/threat-research/valleyrat-campaign-targeting-chinese-speakers)
- [Joe Sandbox - Automated Malware Analysis Report for AutoRecoverDat.dll](https://www.joesandbox.com/analysis/1789157/1/html)
- [Picus Security - Silver Fox APT Targets Public Sector via Trojanized Medical Software](https://www.picussecurity.com/resource/blog/silver-fox-apt-targets-public-sector-via-trojanized-medical-software)
- [MITRE ATT&CK - Reflective Code Loading T1620](https://attack.mitre.org/versions/v16/techniques/T1620/)
- [Splunk - Suspicious Rundll32 DllRegisterServer Detection](https://research.splunk.com/endpoint/8c00a385-9b86-4ac0-8932-c9ec3713b159/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0239