Skip to navigation

Threat reportMalwareTL-2026-1194

SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer

highACTIVE

SilverFox (Void Arachne / SwimSnake / UTG-Q-1000) is running a live campaign delivering ValleyRAT via an eight-stage infection chain: DLL sideloading, ETW/AMSI bypass, PNG steganography, a Donut shellcode loader, a Go-based WebSocket/QUIC RAT, and a kernel-mode rootkit (KernelQuick, 65+ IOCTL command codes) that force-deletes 60+ AV/EDR product files.

Key facts for ValleyRAT EDR killer rootkit

IdentifiersTL-2026-1194
Also known asValleyRAT Kernel Rootkit Campaign, Winos4.0 SilverFox Campaign
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows 11; Multiple AV/EDR Vendors Endpoint security products (targeted for kernel-level file deletion)
Weaknesses (CWE)CWE-506, CWE-829, CWE-311
AttributionVoid Arachne (medium confidence)
Nation-state nexusChina
MalwareKernelQuick, ValleyRAT
ToolsDonut - S0695, Named-pipe RAT-to-rootkit control channel
MITRE ATT&CK techniquesT1005 Data from Local System, T1014 Rootkit, T1027 Obfuscated Files or Information, T1036 Masquerading, T1055 Process Injection, T1059 Command and Scripting Interpreter, T1070 Indicator Removal, T1071 Application Layer Protocol, T1090 Proxy, T1095 Non-Application Layer Protocol, T1106 Native API, T1112 Modify Registry and 16 more in the attack flow
MotivationESPIONAGE
Target sectorspublic sector, finance, medical, technology
Target regionschina, india, taiwan, japan, malaysia, russia, APAC
Detection rules9 (1 shown free)
Sources17 cited sources

Detection coverage for ValleyRAT EDR killer rootkit

As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1194 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SilverFox KernelQuick — Rotating C:\Drivers Staging + Unsigned/Expired Driver Load

Detects the post-exploitation staging and installation of the KernelQuick rootkit driver: files rotating under C:\Drivers and kernel driver load events with expired or invalid code-signing certificates, which allow the rootkit to load even on fully-patched Windows 11 systems.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1014, T1553.002, T1070.004
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=6)
| eval is_drivers_path=if(match(TargetFilename, "(?i)^C:\\\\Drivers\\\\"), 1, 0)
| eval is_expired_sig=if(EventCode=6 AND (Signed="false" OR match(SignatureStatus, "(?i)expired|invalid")), 1, 0)
| where is_drivers_path=1 OR is_expired_sig=1
| eval finding="kernelquick_staging_or_unsigned_driver_load"
| table _time, ComputerName, TargetFilename, ImageLoaded, Signed, SignatureStatus, finding
| sort -_time

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath startswith @"C:\Drivers\"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName
| union (
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad" and (SignatureStatus == "Expired" or IsSigned == false)
| project Timestamp, DeviceName, FileName=FolderPath, FolderPath, InitiatingProcessFileName=SignatureStatus
)
| order by Timestamp desc

Sigma

title: SilverFox KernelQuick Rootkit Staging and Expired-Certificate Driver Load
id: 7c1e9a2e-3b4a-4a2f-9d5a-1a2b3c4d5e02
status: experimental
description: Detects rotating filenames dropped under C:\Drivers (KernelQuick_Hidden.sys staging pattern) and kernel driver load events signed with expired or invalid certificates.
references:
    - https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/10
tags:
    - attack.defense-evasion
    - attack.persistence
    - attack.t1014
    - attack.t1553.002
    - attack.t1070.004
    - attack.tool.kernelquick
logsource:
    product: windows
    category: file_event
detection:
    selection_path:
        TargetFilename|contains: 'C:\Drivers\'
    selection_sig:
        Signed: 'true'
        SignatureStatus: 'Expired'
    condition: selection_path or selection_sig
falsepositives:
    - Legitimate driver-development or staging directories intentionally named C:\Drivers
    - Third-party hardware drivers signed with certificates that expired post-signing but remain trusted per Authenticode timestamping
level: critical

Known false positives:

  • Legitimate driver staging/build directories named C:\Drivers
  • Third-party hardware drivers with Authenticode-timestamped certificates that appear expired

Tuning notes: Exclude known-good driver deployment tooling paths; validate SignatureStatus against a trust-chain check rather than expiry alone to avoid flagging legitimately timestamped certificates.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SilverFox ValleyRAT — MSI VBScript Custom Action Followed by ETW/AMSI Tamper · unlock with TL Creds
  • SilverFox ValleyRAT — Unexpected Child Process Under [indicator] (AV-Killer Injection Pattern) · unlock with TL Creds
  • SilverFox ValleyRAT — KernelQuick Named-Pipe Command Channel and Clipboard Clipper · unlock with TL Creds
  • SilverFox ValleyRAT — PNG Steganography Payload Extraction and Donut Reflective Load · unlock with TL Creds
  • SilverFox KernelQuick — Kernel Driver Force-Delete of AV/EDR Product Files · unlock with TL Creds
  • SilverFox ValleyRAT — VM/Sandbox Evasion Probe Prior to C2 Beacon · unlock with TL Creds
  • SilverFox ValleyRAT — Trojanized Installer DLL Side-Loading · unlock with TL Creds
  • SilverFox ValleyRAT — WebSocket/QUIC C2 Beaconing to Known Domains · unlock with TL Creds

Indicators of compromise for ValleyRAT EDR killer rootkit

As of 2026-07-10, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-1194.

Sample indicators (3 of 21)

  • Domain: 3w[.]jxuw3[.]com
  • File hash: 520304a1cabdd9aa05c0a769c3874bc3cc2608d8e71ae607ca2bdf96b298b5de
  • Domain: df[.]sjickdeh[.]org

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration for ValleyRAT EDR killer rootkit

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How ValleyRAT EDR killer rootkit works

Samples are polymorphically recompiled and file paths rotate daily to evade static detection.

SilverFox — a Chinese threat actor also tracked as Void Arachne, SwimSnake, The Great Thief of Valley, and UTG-Q-1000, active since 2022 and treated as an APT by Western vendors while tracked domestically as a cybercrime actor — is running an active campaign (first reported by Gen Threat Labs on 2026-07-06, still live at time of writing) deploying an enhanced variant of ValleyRAT (aka Winos/Winos4.0), a modular Gh0st RAT-lineage backdoor first identified in 2023.

The infection chain runs eight distinct stages, far beyond the 2-3 stage norm for commodity RATs: (1) DLL sideloading, where a trojanized installer smuggles a malicious DLL alongside a legitimate signed application to gain initial execution; (2) ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) logging bypass/disabling to blind endpoint telemetry and script-scanning; (3) steganographic extraction of a payload hidden in the pixel data of an ordinary-looking PNG image; (4) privilege escalation; (5) extraction of a secondary payload from a second steganographic image; (6) execution of a nested Donut shellcode loader using reflective, memory-only loading to avoid dropping artifacts to disk; (7) deployment of the Go-based ValleyRAT orchestrator, which communicates over WebSocket and QUIC — protocols chosen specifically because they blend into normal encrypted web traffic — and which performs VMware/sandbox detection before proceeding; and (8) installation of a kernel-mode rootkit driver (internally named KernelQuick, service name 'kernelquick', compiled as KernelQuick_Hidden.sys, embedded inside Driver Plugin.dll) that takes direct orders from the user-mode RAT over named pipes.

The kernel rootkit exposes 65+ IOCTL-based command codes. Two identified IOCTLs are 0x222144 (user-mode shellcode injection into a specified process, implemented via an APC-based UMInjection() routine) and 0x222140 (force-delete of arbitrary files). The AV/EDR-killing capability is implemented in a ForceDeleteFile() routine that opens target files via a custom IRP_MJ_CREATE, resets file attributes via IRP_MJ_SET_INFORMATION (FileBasicInformation), and marks them for deletion via FileDispositionInformation — executed automatically at driver initialization against the on-disk driver/binary files of 60+ security products, including Qihoo 360, Kaspersky Lab, Tencent, Kingsoft, and Huorong Security. The RAT separately injects an AV-killing module into svchost.exe, a trusted core Windows process, to disable AV from user mode as well.

The rootkit supports two installation modes: a Normal Mode that installs directly as a SERVICE_KERNEL_DRIVER with demand start, and a Stealth Mode that uses MalSeclogon-based process impersonation with PPID spoofing to dwm.exe during installation to blend the install into a trusted parent process; SetDriverStartType_SystemStart() later elevates the service to SERVICE_SYSTEM_START so the rootkit loads automatically at boot. The driver additionally implements registry key/value hiding, file and directory hiding, process protection with restricted access, and a process-exclusion list, and was observed signed with a valid-but-expired code-signing certificate, allowing it to load on fully-patched Windows 11 systems with all driver-signing protections enabled.

A companion builder tool, Quick.exe (32-bit PE), has been available on GitHub since March 2025 and is used to generate customized RAT/rootkit payload bundles; plugin-specific C2 data is protected with custom XOR-based encryption.

Researchers observed 13 distinct polymorphic samples recompiled over a 12-day window, each varied slightly to defeat signature-based detection, alongside daily rotation of dropped file paths under C:\Drivers to reduce the effectiveness of static detection rules.

Post-compromise, ValleyRAT monitors the Windows clipboard for cryptocurrency wallet addresses and silently swaps them for attacker-controlled addresses (clipper functionality), and separately harvests Telegram data — private conversations and account details — from infected hosts. Additional plugins can be deployed on demand over the named-pipe channel to the kernel component, consistent with ValleyRAT's modular, download-on-demand architecture rather than a single monolithic binary.

SilverFox's broader operational history shows a mixed espionage/cybercrime motive set — intelligence collection, financial gain, cryptomining, and operational disruption — and the group has previously used SEO poisoning, tax-themed phishing, fake software installer sites (including impersonation of Microsoft Teams and the Chinese AV vendor Huorong), and abuse of a Microsoft-signed WatchDog Anti-Malware driver to load malicious kernel components. Financially-motivated artifacts such as clipboard hijacking and cryptomining are assessed by researchers as plausible-deniability misdirection that helps the group's espionage-adjacent operations stay under the radar. Prior ValleyRAT campaigns attributed to SilverFox have targeted organizations and individuals in China, India, Taiwan, Japan, Malaysia, and Russia (including a false-flag campaign with Cyrillic loader artifacts intended to misdirect attribution toward a Russian actor), with victimology spanning public sector, financial, medical, and technology organizations.

Organizations are advised to monitor for: MSI installations invoking VBScript custom actions, anomalous outbound QUIC/WebSocket traffic to unfamiliar domains, kernel driver load events failing normal signing-trust chains or using expired certificates, unauthorized/unusual named-pipe creation and traffic, unexpected child processes spawned under svchost.exe, and file paths appearing/rotating under C:\Drivers.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1115 Clipboard Data

Defense Evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Privilege Escalation

T1055 Process Injection; T1548 Abuse Elevation Control Mechanism

Execution

T1059 Command and Scripting Interpreter; T1106 Native API

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel

defense-impairment

T1112 Modify Registry; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Discovery

T1497 Virtualization/Sandbox Evasion; T1518 Software Discovery

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Credential Access

T1555 Credentials from Password Stores

Initial Access

T1566 Phishing

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Remediation for ValleyRAT EDR killer rootkit

Immediate actions

  • Block the identified C2 domains 3w.jxuw3.com and df.sjickdeh.org at DNS/perimeter
  • Hunt for the trojanized installer SHA-256 520304a1cabdd9aa05c0a769c3874bc3cc2608d8e71ae607ca2bdf96b298b5de across endpoints
  • Alert on kernel driver load events with expired/invalid code-signing certificates
  • Alert on any file/service path activity under C:\Drivers with rotating filenames
  • Alert on child processes spawned under svchost.exe that do not match known-good baselines
  • Monitor for anomalous named-pipe creation and traffic between user-mode and kernel-mode components

Workarounds

  • Enable Windows Defender Application Control (WDAC) or equivalent to block loading of drivers signed with expired/revoked certificates
  • Restrict local admin rights to reduce success of the privilege-escalation and kernel-driver-install stages

Longer-term hardening

  • Deploy EDR with kernel driver load monitoring and code-integrity enforcement (HVCI/Memory Integrity)
  • Enforce application allowlisting to prevent execution of unsigned or newly-seen installers
  • Deploy network detection for QUIC/WebSocket C2 blending techniques (JA3/JA4/TLS fingerprinting, destination reputation)
  • Restrict clipboard-monitoring and crypto-wallet interaction risk via endpoint policy where feasible
  • Maintain an updated blocklist of vulnerable/abusable signed drivers (BYOVD) and enforce Microsoft's vulnerable driver blocklist

Affected and fixed versions

  • Microsoft — Windows 11
    Vulnerable versions: all supported builds with default driver signing
  • Multiple AV/EDR Vendors — Endpoint security products (targeted for kernel-level file deletion)
    Vulnerable versions: Qihoo 360; Kaspersky Lab; Tencent; Kingsoft; Huorong Security; 60+ total vendors

Timeline of ValleyRAT EDR killer rootkit

  • locked-ioc-19 (Winos/Winos4.0) first identified as a modular Gh0st RAT-lineage backdoor attributed to SilverFox.
  • SilverFox observed spoofing a Chinese healthcare DICOM-viewer app to deliver locked-ioc-19.
  • The locked-ioc-19 rootkit builder tool (locked-ioc-18) becomes available on GitHub.
  • SilverFox (Void Arachne) reported using fake websites to deliver Sainbox RAT and a hidden rootkit.
  • SilverFox reported exploiting a Microsoft-signed WatchDog Anti-Malware driver to deploy locked-ioc-19.
  • SilverFox runs a fake Microsoft Teams installer / tax-themed campaign against Indian and Chinese targets delivering locked-ioc-19, including Cyrillic-obfuscated loader artifacts assessed as a false-flag toward Russian attribution.
  • SilverFox expands operations across Asia with AtlasCross RAT and additional fake domains.
  • Researchers begin observing the 12-day window of 13 polymorphically recompiled locked-ioc-19 samples for this campaign (approximate start, 12 days before publication).
  • TL-Intel-Harness ingests the campaign via the Cyber Security News RSS feed for hunt/research.
  • locked-ioc-11 findings on the eight-stage locked-ioc-19/kernel-rootkit campaign are reported publicly by Cyber Security News, GBHackers, Security Boulevard, and Cyberpress; campaign is confirmed still live at time of writing.

Sources cited for ValleyRAT EDR killer rootkit

Showing 15 of 17 sources, primary sources first.

More from Void Arachne

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 17 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats