SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer — Threadlinqs Intelligence
As of 2026-07-10, SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer is a high-severity malware threat attributed to Void Arachne (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-1194 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Void Arachne · China · ESPIONAGE
SilverFox (Void Arachne / SwimSnake / UTG-Q-1000) is running a live campaign delivering ValleyRAT via an eight-stage infection chain: DLL sideloading, ETW/AMSI bypass, PNG steganography, a Donut
SilverFox — a Chinese threat actor also tracked as Void Arachne, SwimSnake, The Great Thief of Valley, and UTG-Q-1000, active since 2022 and treated as an APT by Western vendors while tracked domestically as a cybercrime actor — is running an active campaign (first reported by Gen Threat Labs on 2026-07-06, still live at time of writing) deploying an enhanced variant of ValleyRAT (aka Winos/Winos4.0), a modular Gh0st RAT-lineage backdoor first identified in 2023.
The infection chain runs eight distinct stages, far beyond the 2-3 stage norm for commodity RATs: (1) DLL sideloading, where a trojanized installer smuggles a malicious DLL alongside a legitimate signed application to gain initial execution; (2) ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) logging bypass/disabling to blind endpoint telemetry and script-scanning; (3) steganographic extraction of a payload hidden in the pixel data of an ordinary-looking PNG image; (4) privilege escalation; (5) extraction of a secondary payload from a second steganographic image; (6) execution of a nested Donut shellcode loader using reflective, memory-only loading to avoid dropping artifacts to disk; (7) deployment of the Go-based ValleyRAT orchestrator, which communicates over WebSocket and QUIC — protocols chosen specifically because they blend into normal encrypted web traffic — and which performs VMware/sandbox detection before proceeding; and (8) installation of a kernel-mode rootkit driver (internally named KernelQuick, service name 'kernelquick', compiled as KernelQuick_Hidden.sys, embedded inside Driver Plugin.dll) that takes direct orders from the user-mode RAT over named pipes.
The kernel rootkit exposes 65+ IOCTL-based command codes. Two identified IOCTLs are 0x222144 (user-mode shellcode injection into a specified process, implemented via an APC-based UMInjection() routine) and 0x222140 (force-delete of arbitrary files). The AV/EDR-killing capability is implemented in a ForceDeleteFile() routine that opens target files via a custom IRP_MJ_CREATE, resets file attributes via IRP_MJ_SET_INFORMATION (FileBasicInformation), and marks them for deletion via FileDispositionInformation — executed automatically at driver initialization against the on-disk driver/binary files of 60+ security products, including Qihoo 360, Kaspersky Lab, Tencent, Kingsoft, and Huorong Security. The RAT separately injects an AV-killing module into svchost.exe, a trusted core Windows process, to disable AV from user mode as well.
The rootkit supports two installation modes: a Normal Mode that installs directly as a SERVICE_KERNEL_DRIVER with demand start, and a Stealth Mode that uses MalSeclogon-based process impersonation with PPID spoofing to dwm.exe during installation to blend the install into a trusted parent process; SetDriverStartType_SystemStart() later elevates the service to SERVICE_SYSTEM_START so the rootkit loads automatically at boot. The driver additionally implements registry key/value hiding, file and directory hiding, process protection with restricted access, and a process-exclusion list, and was observed signed with a valid-but-expired code-signing certificate, allowing it to load on fully-patched Windows 11 systems with all driver-signing protections enabled.
A companion builder tool, Quick.exe (32-bit PE), has been available on GitHub since March 2025 and is used to generate customized RAT/rootkit payload bundles; plugin-specific C2 data is protected with custom XOR-based encryption.
Researchers observed 13 distinct polymorphic samples recompiled over a 12-day window, each varied slightly to defeat signature-based detection, alongside daily rotation of dropped file paths under C:\Drivers to reduce the effectiveness of static detection rules.
Post-compromise, ValleyRAT monitors the Windows clipboard for cryptocurrency wallet addresses and silently swaps them for attacker-controlled addresses (clipper functionality), and separately harvests Telegram data
Weaknesses (CWE)
CWE-506, CWE-829, CWE-311
Target sectors: public sector, finance, medical, technology
Target regions: china, india, taiwan, japan, malaysia, russia, APAC
Detections & IOCs
As of 2026-08-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1059, T1106, T1547, T1543, T1548, T1055, T1685, T1574, T1140
