Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS Installer and DLL Sideloading of Tencent GameBox.exe (Silver Fox APT) — Threadlinqs Intelligence
As of 2026-05-30, Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS Installer and DLL Sideloading of Tencent GameBox.exe (Silver Fox APT) is a high-severity malware threat attributed to Silver Fox APT (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0538 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Silver Fox APT · China · ESPIONAGE
K7 Labs disclosed a Silver Fox APT campaign that uses lookalike Microsoft Teams download sites (teams-securecall[.]com, teamszs[.]com) shared on X in mid-April 2026 to deliver a trojanized NSIS
Overview
On 20 May 2026, K7 Computing's threat research lab (K7 Labs) published a detailed teardown of a malware distribution campaign in which threat actors impersonate Microsoft Teams to socially engineer victims into running a trojanized NSIS installer. Researcher Srinivasan E attributes the activity to Silver Fox APT (a China-nexus crimeware/espionage cluster also associated with the ValleyRAT/Winos family) based on Chinese-language artifacts in the staging sites, registry key naming overlap with prior ValleyRAT samples (HKCU\SOFTWARE\IpDates_info, HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e), and consistent tradecraft involving Tencent-signed binary abuse.
Delivery and Initial Access
Lures were seeded on X (formerly Twitter) starting mid-April 2026, directing users to lookalike domains teams-securecall[.]com and teamszs[.]com that clone the legitimate Microsoft Teams download page. Victims download a zip archive with one of the observed names 98653.2.87.teamsx.zip, 571.0.2.6.8.97teamsxb.zip, or 521.0.3.6.987teamsx.zip. The archive contains a NSIS (Nullsoft Scriptable Install System) installer that doubles as a dropper, deploying a legitimate signed Tencent executable GameBox.exe, a malicious sideload DLL Utility.dll, an AES-encrypted shellcode blob user.dat, supporting binaries, and a genuine Microsoft Teams installer plus a desktop shortcut to mask the compromise.
Exploit / Execution Chain
1. User extracts the zip and runs the NSIS installer, which writes payload components to C:\ProgramData\client and creates the decoy Teams shortcut.
2. GameBox.exe (legitimately signed by Tencent and a known target for DLL search-order abuse) is launched and side-loads the attacker-controlled Utility.dll (T1574.002).
3. Utility.dll spawns PowerShell to issue Add-MpPreference -ExclusionPath 'C:\ProgramData\client' and Add-MpPreference -ExclusionProcess 'Utility.dll', neutralizing Microsoft Defender for the staging directory and the loader image (T1562.001).
4. The loader calls SetFileAttributes with value 7 (READONLY|HIDDEN|SYSTEM) on its working directory to hide the dropped tree (T1564.001).
5. A Windows service named _CCGDAT is created via the service control manager with start type 2 (auto-start) to maintain persistence across reboots (T1543.003).
6. Utility.dll opens user.dat, derives an AES key/IV, and calls BCryptDecrypt to decrypt the second-stage shellcode loader entirely in memory (T1140).
7. The second-stage loader resolves Windows APIs by hash rather than name (T1027.007), allocates RWX memory in the current GameBox.exe process, copies the decrypted shellcode in, and invokes CreateThread to execute it in-process (T1055.001).
8. The second stage contains an embedded config of reversed key:value pairs (e.g., 103.215.77.17|0:db|0:lk|0:hs|...) describing C2 IP, ports 4499 (twice), campaign id smaet, version 1.0.0.721, malware build 9.4.6202, and feature toggles. It opens a TCP socket to 103.215.77.17 on port 4499 and pulls down the third stage.
9. The third stage is XOR-decoded in place, revealing a PE with an exported load function. A reflective loader maps the PE into memory and calls load, yielding the ValleyRAT module (T1620).
10. ValleyRAT registers clipboard monitoring (GetClipboardData) (T1115), logs keystrokes and operational data to a local file (T1056.001), and exfiltrates collected data back over the existing TCP C2 channel (T1041). Configuration data is staged in HKCU\SOFTWARE\IpDates_info (set to QWORD 0 in this build) and HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.
C2 Infrastructure
The C2 endpoint observed in this build is 103.215.77.17:4499 (TCP). The configuration string indicates two redundant connection slots (1t/2t) both pointed at the same IP/port in this sample, with additional fields for build/version, campaign tag smaet, and a feature-toggle bitmap. Both backup slots ('bb' and 'pj') are populated, consistent with prior ValleyRAT samples that support fallback C2 over the same custom binary
Weaknesses (CWE)
CWE-427, CWE-829, CWE-94
Target sectors: technology, professional services, general public, remote workforce, small and medium business
Target regions: China, Asia-Pacific, Global (English-language Microsoft Teams users)
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1189, T1566, T1204, T1059, T1106, T1543, T1574, T1562