# Fake Microsoft Teams Sites Deliver ValleyRAT via NSIS Installer and DLL Sideloading of Tencent GameBox.exe (Silver Fox APT)

> K7 Labs disclosed a Silver Fox APT campaign that uses lookalike Microsoft Teams download sites (teams-securecall[.]com, teamszs[.]com) shared on X in mid-April 2026 to deliver a trojanized NSIS installer. The chain sideloads a malicious utility.dll via the signed Tencent GameBox.exe, weakens Microsoft Defender with PowerShell exclusions, installs a _CCGDAT service for persistence, and stages an AES-encrypted user.dat shellcode that ultimately deploys a ValleyRAT variant capable of clipboard theft and keylogging over TCP to 103.215.77.17.

- **Published:** 2026-05-20T12:00:00Z
- **Last reviewed:** 2026-05-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0538
- **ID:** TL-2026-0538
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Silver Fox APT (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Overview

On 20 May 2026, K7 Computing's threat research lab (K7 Labs) published a detailed teardown of a malware distribution campaign in which threat actors impersonate Microsoft Teams to socially engineer victims into running a trojanized NSIS installer. Researcher Srinivasan E attributes the activity to Silver Fox APT (a China-nexus crimeware/espionage cluster also associated with the ValleyRAT/Winos family) based on Chinese-language artifacts in the staging sites, registry key naming overlap with prior ValleyRAT samples (HKCU\SOFTWARE\IpDates_info, HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e), and consistent tradecraft involving Tencent-signed binary abuse.

Delivery and Initial Access

Lures were seeded on X (formerly Twitter) starting mid-April 2026, directing users to lookalike domains teams-securecall[.]com and teamszs[.]com that clone the legitimate Microsoft Teams download page. Victims download a zip archive with one of the observed names 98653.2.87.teamsx.zip, 571.0.2.6.8.97teamsxb.zip, or 521.0.3.6.987teamsx.zip. The archive contains a NSIS (Nullsoft Scriptable Install System) installer that doubles as a dropper, deploying a legitimate signed Tencent executable GameBox.exe, a malicious sideload DLL Utility.dll, an AES-encrypted shellcode blob user.dat, supporting binaries, and a genuine Microsoft Teams installer plus a desktop shortcut to mask the compromise.

Exploit / Execution Chain

1. User extracts the zip and runs the NSIS installer, which writes payload components to C:\ProgramData\client and creates the decoy Teams shortcut.
2. GameBox.exe (legitimately signed by Tencent and a known target for DLL search-order abuse) is launched and side-loads the attacker-controlled Utility.dll (T1574.002).
3. Utility.dll spawns PowerShell to issue Add-MpPreference -ExclusionPath 'C:\ProgramData\client' and Add-MpPreference -ExclusionProcess 'Utility.dll', neutralizing Microsoft Defender for the staging directory and the loader image (T1562.001).
4. The loader calls SetFileAttributes with value 7 (READONLY|HIDDEN|SYSTEM) on its working directory to hide the dropped tree (T1564.001).
5. A Windows service named _CCGDAT is created via the service control manager with start type 2 (auto-start) to maintain persistence across reboots (T1543.003).
6. Utility.dll opens user.dat, derives an AES key/IV, and calls BCryptDecrypt to decrypt the second-stage shellcode loader entirely in memory (T1140).
7. The second-stage loader resolves Windows APIs by hash rather than name (T1027.007), allocates RWX memory in the current GameBox.exe process, copies the decrypted shellcode in, and invokes CreateThread to execute it in-process (T1055.001).
8. The second stage contains an embedded config of reversed key:value pairs (e.g., 103.215.77.17|0:db|0:lk|0:hs|...) describing C2 IP, ports 4499 (twice), campaign id smaet, version 1.0.0.721, malware build 9.4.6202, and feature toggles. It opens a TCP socket to 103.215.77.17 on port 4499 and pulls down the third stage.
9. The third stage is XOR-decoded in place, revealing a PE with an exported load function. A reflective loader maps the PE into memory and calls load, yielding the ValleyRAT module (T1620).
10. ValleyRAT registers clipboard monitoring (GetClipboardData) (T1115), logs keystrokes and operational data to a local file (T1056.001), and exfiltrates collected data back over the existing TCP C2 channel (T1041). Configuration data is staged in HKCU\SOFTWARE\IpDates_info (set to QWORD 0 in this build) and HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.

C2 Infrastructure

The C2 endpoint observed in this build is 103.215.77.17:4499 (TCP). The configuration string indicates two redundant connection slots (1t/2t) both pointed at the same IP/port in this sample, with additional fields for build/version, campaign tag smaet, and a feature-toggle bitmap. Both backup slots ('bb' and 'pj') are populated, consistent with prior ValleyRAT samples that support fallback C2 over the same custom binary TCP protocol on high ports.

Attribution

K7 Labs assesses this campaign as Silver Fox APT activity with medium-to-high confidence. Indicators supporting the attribution include: (a) Chinese-language artifacts in the fake Teams sites and execution logs, (b) reuse of the HKCU\SOFTWARE\IpDates_info registry path observed in earlier ValleyRAT/Winos 4.0 intrusions, (c) reuse of the secondary configuration key 451b464b7a6c2ced348c1866b59c362e seen across the ValleyRAT lineage, (d) the consistent Silver Fox tradecraft of abusing legitimate Chinese-vendor signed binaries (Tencent GameBox.exe in this case) to evade signature-based controls, and (e) lure infrastructure characteristics typical of the cluster.

Impact and Risk

ValleyRAT provides full remote access: command execution, file transfer, clipboard theft, keylogging, and downloader functionality for additional modules. Because the loader executes in the address space of a legitimately signed Tencent process and disables Defender within its working directory, traditional AV signatures and behavioral heuristics on the loader process are blinded. Enterprises permitting installation of Tencent gaming software (or lacking application allowlisting) are particularly exposed.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1082 System Information Discovery
- T1115 Clipboard Data
- T1056 Input Capture
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL Sideloading](https://labs.k7computing.com/index.php/fake-microsoft-teams-campaign-delivers-valleyrat-via-nsis-installer-and-dll-sideloading/)
- [MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK T1543.003 — Create or Modify System Process: Windows Service](https://attack.mitre.org/techniques/T1543/003/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1620 — Reflective Code Loading](https://attack.mitre.org/techniques/T1620/)
- [MITRE ATT&CK T1115 — Clipboard Data](https://attack.mitre.org/techniques/T1115/)
- [MITRE ATT&CK Software S1199 — ValleyRAT](https://attack.mitre.org/software/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0538