Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS Installer and DLL Sideloading of Tencent GameBox.exe (Silver Fox APT)
Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS (TL-2026-0538), also tracked as Fake Teams ValleyRAT Campaign, is a high-severity malware campaign, first published 2026-05-20. It is attributed to Silver Fox APT (China) with medium confidence, affects Microsoft Windows (10 / 11 / Server), maps to 23 MITRE ATT&CK techniques (T1027, T1036, T1041), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0538
- Threat ID
- TL-2026-0538
- Also known as
- Fake Teams ValleyRAT Campaign, GameBox Sideload Campaign, _CCGDAT service implant
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-20
- Last reviewed
- 2026-05-20
- Attribution
- Silver Fox APT
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- technology, professional services, general public, remote workforce, small and medium business
- Target regions
- China, Asia-Pacific, Global (English-language Microsoft Teams users)
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
Malware and tooling: ValleyRAT, NSIS Installer, ValleyRAT custom TCP C2
K7 Labs disclosed a Silver Fox APT campaign that uses lookalike Microsoft Teams download sites (teams-securecall[.]com, teamszs[.]com) shared on X in mid-April 2026 to deliver a trojanized NSIS installer. The chain sideloads a malicious utility.dll via the signed Tencent GameBox.exe, weakens Microsoft Defender with PowerShell exclusions, installs a _CCGDAT service for persistence, and stages an AES-encrypted user.dat shellcode that ultimately deploys a ValleyRAT variant capable of clipboard theft and keylogging over TCP to 103.215.77.17.
How Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS works
Overview
On 20 May 2026, K7 Computing's threat research lab (K7 Labs) published a detailed teardown of a malware distribution campaign in which threat actors impersonate Microsoft Teams to socially engineer victims into running a trojanized NSIS installer. Researcher Srinivasan E attributes the activity to Silver Fox APT (a China-nexus crimeware/espionage cluster also associated with the ValleyRAT/Winos family) based on Chinese-language artifacts in the staging sites, registry key naming overlap with prior ValleyRAT samples (HKCU\SOFTWARE\IpDates_info, HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e), and consistent tradecraft involving Tencent-signed binary abuse.
Delivery and Initial Access
Lures were seeded on X (formerly Twitter) starting mid-April 2026, directing users to lookalike domains teams-securecall[.]com and teamszs[.]com that clone the legitimate Microsoft Teams download page. Victims download a zip archive with one of the observed names 98653.2.87.teamsx.zip, 571.0.2.6.8.97teamsxb.zip, or 521.0.3.6.987teamsx.zip. The archive contains a NSIS (Nullsoft Scriptable Install System) installer that doubles as a dropper, deploying a legitimate signed Tencent executable GameBox.exe, a malicious sideload DLL Utility.dll, an AES-encrypted shellcode blob user.dat, supporting binaries, and a genuine Microsoft Teams installer plus a desktop shortcut to mask the compromise.
Exploit / Execution Chain
1. User extracts the zip and runs the NSIS installer, which writes payload components to C:\ProgramData\client and creates the decoy Teams shortcut. 2. GameBox.exe (legitimately signed by Tencent and a known target for DLL search-order abuse) is launched and side-loads the attacker-controlled Utility.dll (T1574.002). 3. Utility.dll spawns PowerShell to issue Add-MpPreference -ExclusionPath 'C:\ProgramData\client' and Add-MpPreference -ExclusionProcess 'Utility.dll', neutralizing Microsoft Defender for the staging directory and the loader image (T1562.001). 4. The loader calls SetFileAttributes with value 7 (READONLY|HIDDEN|SYSTEM) on its working directory to hide the dropped tree (T1564.001). 5. A Windows service named _CCGDAT is created via the service control manager with start type 2 (auto-start) to maintain persistence across reboots (T1543.003). 6. Utility.dll opens user.dat, derives an AES key/IV, and calls BCryptDecrypt to decrypt the second-stage shellcode loader entirely in memory (T1140). 7. The second-stage loader resolves Windows APIs by hash rather than name (T1027.007), allocates RWX memory in the current GameBox.exe process, copies the decrypted shellcode in, and invokes CreateThread to execute it in-process (T1055.001). 8. The second stage contains an embedded config of reversed key:value pairs (e.g., 103.215.77.17|0:db|0:lk|0:hs|...) describing C2 IP, ports 4499 (twice), campaign id smaet, version 1.0.0.721, malware build 9.4.6202, and feature toggles. It opens a TCP socket to 103.215.77.17 on port 4499 and pulls down the third stage. 9. The third stage is XOR-decoded in place, revealing a PE with an exported load function. A reflective loader maps the PE into memory and calls load, yielding the ValleyRAT module (T1620). 10. ValleyRAT registers clipboard monitoring (GetClipboardData) (T1115), logs keystrokes and operational data to a local file (T1056.001), and exfiltrates collected data back over the existing TCP C2 channel (T1041). Configuration data is staged in HKCU\SOFTWARE\IpDates_info (set to QWORD 0 in this build) and HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.
C2 Infrastructure
The C2 endpoint observed in this build is 103.215.77.17:4499 (TCP). The configuration string indicates two redundant connection slots (1t/2t) both pointed at the same IP/port in this sample, with additional fields for build/version, campaign tag smaet, and a feature-toggle bitmap. Both backup slots ('bb' and 'pj') are populated, consistent with prior ValleyRAT samples that support fallback C2 over the same custom binary TCP protocol on high ports.
Attribution
K7 Labs assesses this campaign as Silver Fox APT activity with medium-to-high confidence. Indicators supporting the attribution include: (a) Chinese-language artifacts in the fake Teams sites and execution logs, (b) reuse of the HKCU\SOFTWARE\IpDates_info registry path observed in earlier ValleyRAT/Winos 4.0 intrusions, (c) reuse of the secondary configuration key 451b464b7a6c2ced348c1866b59c362e seen across the ValleyRAT lineage, (d) the consistent Silver Fox tradecraft of abusing legitimate Chinese-vendor signed binaries (Tencent GameBox.exe in this case) to evade signature-based controls, and (e) lure infrastructure characteristics typical of the cluster.
Impact and Risk
ValleyRAT provides full remote access: command execution, file transfer, clipboard theft, keylogging, and downloader functionality for additional modules. Because the loader executes in the address space of a legitimately signed Tencent process and disables Defender within its working directory, traditional AV signatures and behavioral heuristics on the loader process are blinded. Enterprises permitting installation of Tencent gaming software (or lacking application allowlisting) are particularly exposed.
MITRE ATT&CK techniques used in TL-2026-0538
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts; T1574 Hijack Execution Flow; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Collection
T1056 Input Capture; T1115 Clipboard Data
Execution
T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution
Discovery
T1082 System Information Discovery
Command and Control
T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Persistence
T1543 Create or Modify System Process
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
- Microsoft — Windows (10 / 11 / Server)
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Tencent — GameBox.exe (signed binary abused for DLL sideloading)
Vulnerable versions: all versions vulnerable to DLL search-order hijack of utility.dll - Microsoft — Microsoft Teams (impersonated brand)
Vulnerable versions: all (lure target)
Remediation for Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
Immediate actions
- Block egress to 103.215.77.17 (TCP/4499) at perimeter and EDR network filters
- Sinkhole or DNS-block teams-securecall[.]com and teamszs[.]com
- Hunt for the _CCGDAT service across the estate: Get-Service -Name '_CCGDAT' or sc query _CCGDAT on endpoints
- Hunt for HKCU\SOFTWARE\IpDates_info and HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e registry artifacts
- Search for the file hashes 709604CE58E3F8255587AC9253DB6994 (zip), 18F3E85D7237E3CAC0AD13BDCF513F0F (Utility.dll), and 8F9DE887E9AED9D580F386BA2D191319 (user.dat)
- Quarantine any C:\ProgramData\client directories and review Add-MpPreference exclusion history
Workarounds
- Disable interactive PowerShell for non-admin users via Constrained Language Mode and AppLocker policies
- Force Defender ASR rule 'Block process creations originating from PSExec and WMI commands' and 'Block all Office applications from creating child processes' where relevant
- Block creation of services with names beginning with an underscore via Sysmon and an SOC alert
Longer-term hardening
- Enforce application allowlisting (WDAC / AppLocker) to prevent unauthorized signed Tencent binaries from executing on corporate endpoints
- Deploy EDR rules that detect DLL search-order hijacks against Tencent GameBox.exe and similar Chinese-vendor signed binaries known to be abused for sideloading
- Tamper-protect Microsoft Defender and audit Add-MpPreference exclusion changes centrally via Defender for Endpoint
- Block download of executable zip archives served from non-Microsoft domains for Teams and other M365 applications via web proxy / SWG policies
- Train users that Microsoft Teams is delivered only via the Microsoft 365 admin portal or microsoft.com domain
Weaknesses (CWE) in Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
CWE-427, CWE-829, CWE-94
Timeline of Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
- Lookalike Microsoft Teams sites (teams-securecall[.]com, teamszs[.]com) begin appearing in posts on X (Twitter) directing users to download trojanized teams zip archives.
- K7 telemetry observes initial victim downloads of 98653.2.87.teamsx.zip and execution of the NSIS installer with side-loaded Utility.dll via Tencent GameBox.exe.
- TCP beacons to C2 server 103.215.77.17 on port 4499 captured from infected hosts; second-stage shellcode and ValleyRAT module retrieved over the channel.
- K7 analysts correlate HKCU\SOFTWARE\IpDates_info and HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e registry artifacts plus Chinese-language strings with prior Silver Fox APT / ValleyRAT activity.
- Reverse engineering of Utility.dll completed; BCryptDecrypt AES routine for user.dat, in-process shellcode injection via CreateThread, and reflective loading of the third-stage PE confirmed.
- Final IOC list curated: zip hash 709604CE58E3F8255587AC9253DB6994, utility.dll 18F3E85D7237E3CAC0AD13BDCF513F0F, user.dat 8F9DE887E9AED9D580F386BA2D191319, C2 103.215.77.17, service _CCGDAT.
- Threadlinqs Intelligence ingests, enriches, and publishes the threat as TL-2026-0538 with MITRE mapping, IOCs, detections, and simulations.
- K7 Labs publishes the full technical analysis 'Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading' by Srinivasan E.
- As of 2026-05-29, this Silver Fox APT fake-Teams ValleyRAT campaign remains active and live: disclosed by K7 Labs only on 2026-05-20 with lures running since mid-April, no takedown, sinkhole, or arrests reported. Silver Fox is among 2026's most prolific China-nexus actors (parallel tax-lure, fake Telegram, and ByteDance/Tencent sideloading campaigns), and the signed-binary DLL-sideload technique stays viable.
Sources cited for Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
- Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading
- MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading
- MITRE ATT&CK T1543.003 — Create or Modify System Process: Windows Service
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
- MITRE ATT&CK T1620 — Reflective Code Loading
- MITRE ATT&CK T1115 — Clipboard Data
- MITRE ATT&CK Software S1199 — ValleyRAT
Threats related to Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS
- ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence
- SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD
- Mustang Panda LOTUSLITE Backdoor & StealC Campaigns Exploiting Middle East Conflict Themes
Detection coverage for TL-2026-0538
As of 2026-05-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0538 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.