# SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer

> SilverFox (Void Arachne / SwimSnake / UTG-Q-1000) is running a live campaign delivering ValleyRAT via an eight-stage infection chain: DLL sideloading, ETW/AMSI bypass, PNG steganography, a Donut shellcode loader, a Go-based WebSocket/QUIC RAT, and a kernel-mode rootkit (KernelQuick, 65+ IOCTL command codes) that force-deletes 60+ AV/EDR product files. Samples are polymorphically recompiled and file paths rotate daily to evade static detection.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1194
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-valleyrat-edr-killer-rootkit-tl-2026-1194.webp?v=0ad72f02 (Threadlinqs threat intel: ValleyRAT SilverFox EDR Killer Rootkit: Detection & IOCs (TL-2026-1194) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-1194
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Void Arachne (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

SilverFox — a Chinese threat actor also tracked as Void Arachne, SwimSnake, The Great Thief of Valley, and UTG-Q-1000, active since 2022 and treated as an APT by Western vendors while tracked domestically as a cybercrime actor — is running an active campaign (first reported by Gen Threat Labs on 2026-07-06, still live at time of writing) deploying an enhanced variant of ValleyRAT (aka Winos/Winos4.0), a modular Gh0st RAT-lineage backdoor first identified in 2023.

The infection chain runs eight distinct stages, far beyond the 2-3 stage norm for commodity RATs: (1) DLL sideloading, where a trojanized installer smuggles a malicious DLL alongside a legitimate signed application to gain initial execution; (2) ETW (Event Tracing for Windows) and AMSI (Antimalware Scan Interface) logging bypass/disabling to blind endpoint telemetry and script-scanning; (3) steganographic extraction of a payload hidden in the pixel data of an ordinary-looking PNG image; (4) privilege escalation; (5) extraction of a secondary payload from a second steganographic image; (6) execution of a nested Donut shellcode loader using reflective, memory-only loading to avoid dropping artifacts to disk; (7) deployment of the Go-based ValleyRAT orchestrator, which communicates over WebSocket and QUIC — protocols chosen specifically because they blend into normal encrypted web traffic — and which performs VMware/sandbox detection before proceeding; and (8) installation of a kernel-mode rootkit driver (internally named KernelQuick, service name 'kernelquick', compiled as KernelQuick_Hidden.sys, embedded inside Driver Plugin.dll) that takes direct orders from the user-mode RAT over named pipes.

The kernel rootkit exposes 65+ IOCTL-based command codes. Two identified IOCTLs are 0x222144 (user-mode shellcode injection into a specified process, implemented via an APC-based UMInjection() routine) and 0x222140 (force-delete of arbitrary files). The AV/EDR-killing capability is implemented in a ForceDeleteFile() routine that opens target files via a custom IRP_MJ_CREATE, resets file attributes via IRP_MJ_SET_INFORMATION (FileBasicInformation), and marks them for deletion via FileDispositionInformation — executed automatically at driver initialization against the on-disk driver/binary files of 60+ security products, including Qihoo 360, Kaspersky Lab, Tencent, Kingsoft, and Huorong Security. The RAT separately injects an AV-killing module into svchost.exe, a trusted core Windows process, to disable AV from user mode as well.

The rootkit supports two installation modes: a Normal Mode that installs directly as a SERVICE_KERNEL_DRIVER with demand start, and a Stealth Mode that uses MalSeclogon-based process impersonation with PPID spoofing to dwm.exe during installation to blend the install into a trusted parent process; SetDriverStartType_SystemStart() later elevates the service to SERVICE_SYSTEM_START so the rootkit loads automatically at boot. The driver additionally implements registry key/value hiding, file and directory hiding, process protection with restricted access, and a process-exclusion list, and was observed signed with a valid-but-expired code-signing certificate, allowing it to load on fully-patched Windows 11 systems with all driver-signing protections enabled.

A companion builder tool, Quick.exe (32-bit PE), has been available on GitHub since March 2025 and is used to generate customized RAT/rootkit payload bundles; plugin-specific C2 data is protected with custom XOR-based encryption.

Researchers observed 13 distinct polymorphic samples recompiled over a 12-day window, each varied slightly to defeat signature-based detection, alongside daily rotation of dropped file paths under C:\Drivers to reduce the effectiveness of static detection rules.

Post-compromise, ValleyRAT monitors the Windows clipboard for cryptocurrency wallet addresses and silently swaps them for attacker-controlled addresses (clipper functionality), and separately harvests Telegram data — private conversations and account details — from infected hosts. Additional plugins can be deployed on demand over the named-pipe channel to the kernel component, consistent with ValleyRAT's modular, download-on-demand architecture rather than a single monolithic binary.

SilverFox's broader operational history shows a mixed espionage/cybercrime motive set — intelligence collection, financial gain, cryptomining, and operational disruption — and the group has previously used SEO poisoning, tax-themed phishing, fake software installer sites (including impersonation of Microsoft Teams and the Chinese AV vendor Huorong), and abuse of a Microsoft-signed WatchDog Anti-Malware driver to load malicious kernel components. Financially-motivated artifacts such as clipboard hijacking and cryptomining are assessed by researchers as plausible-deniability misdirection that helps the group's espionage-adjacent operations stay under the radar. Prior ValleyRAT campaigns attributed to SilverFox have targeted organizations and individuals in China, India, Taiwan, Japan, Malaysia, and Russia (including a false-flag campaign with Cyrillic loader artifacts intended to misdirect attribution toward a Russian actor), with victimology spanning public sector, financial, medical, and technology organizations.

Organizations are advised to monitor for: MSI installations invoking VBScript custom actions, anomalous outbound QUIC/WebSocket traffic to unfamiliar domains, kernel driver load events failing normal signing-trust chains or using expired certificates, unauthorized/unusual named-pipe creation and traffic, unexpected child processes spawned under svchost.exe, and file paths appearing/rotating under C:\Drivers.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1574 Hijack Execution Flow
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1112 Modify Registry
- T1070 Indicator Removal
- T1014 Rootkit
- T1553 Subvert Trust Controls
- T1684.001 Impersonation
- T1497 Virtualization/Sandbox Evasion
- T1555 Credentials from Password Stores
- T1497 Virtualization/Sandbox Evasion
- T1518 Software Discovery
- T1005 Data from Local System
- T1115 Clipboard Data
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SilverFox KernelQuick — Rotating C:\Drivers Staging + Unsigned/Expired Driver Load** (`TL-2026-1194-SPL-002`)

Detects the post-exploitation staging and installation of the KernelQuick rootkit driver: files rotating under C:\Drivers and kernel driver load events with expired or invalid code-signing certificates, which allow the rootkit to load even on fully-patched Windows 11 systems.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1014, T1553.002, T1070.004
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=6)
| eval is_drivers_path=if(match(TargetFilename, "(?i)^C:\\\\Drivers\\\\"), 1, 0)
| eval is_expired_sig=if(EventCode=6 AND (Signed="false" OR match(SignatureStatus, "(?i)expired|invalid")), 1, 0)
| where is_drivers_path=1 OR is_expired_sig=1
| eval finding="kernelquick_staging_or_unsigned_driver_load"
| table _time, ComputerName, TargetFilename, ImageLoaded, Signed, SignatureStatus, finding
| sort -_time
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath startswith @"C:\Drivers\"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName
| union (
DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "DriverLoad" and (SignatureStatus == "Expired" or IsSigned == false)
| project Timestamp, DeviceName, FileName=FolderPath, FolderPath, InitiatingProcessFileName=SignatureStatus
)
| order by Timestamp desc
```

### Sigma

```yaml
title: SilverFox KernelQuick Rootkit Staging and Expired-Certificate Driver Load
id: 7c1e9a2e-3b4a-4a2f-9d5a-1a2b3c4d5e02
status: experimental
description: Detects rotating filenames dropped under C:\Drivers (KernelQuick_Hidden.sys staging pattern) and kernel driver load events signed with expired or invalid certificates.
references:
    - https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/07/10
tags:
    - attack.defense-evasion
    - attack.persistence
    - attack.t1014
    - attack.t1553.002
    - attack.t1070.004
    - attack.tool.kernelquick
logsource:
    product: windows
    category: file_event
detection:
    selection_path:
        TargetFilename|contains: 'C:\Drivers\'
    selection_sig:
        Signed: 'true'
        SignatureStatus: 'Expired'
    condition: selection_path or selection_sig
falsepositives:
    - Legitimate driver-development or staging directories intentionally named C:\Drivers
    - Third-party hardware drivers signed with certificates that expired post-signing but remain trusted per Authenticode timestamping
level: critical
```

**Known false positives:**

- Legitimate driver staging/build directories named C:\Drivers
- Third-party hardware drivers with Authenticode-timestamped certificates that appear expired

**Tuning notes:** Exclude known-good driver deployment tooling paths; validate SignatureStatus against a trust-chain check rather than expiry alone to avoid flagging legitimately timestamped certificates.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SilverFox ValleyRAT — MSI VBScript Custom Action Followed by ETW/AMSI Tamper (locked: unlock with TL Creds)
- SilverFox ValleyRAT — Unexpected Child Process Under [indicator] (AV-Killer Injection Pattern) (locked: unlock with TL Creds)
- SilverFox ValleyRAT — KernelQuick Named-Pipe Command Channel and Clipboard Clipper (locked: unlock with TL Creds)
- SilverFox ValleyRAT — PNG Steganography Payload Extraction and Donut Reflective Load (locked: unlock with TL Creds)
- SilverFox KernelQuick — Kernel Driver Force-Delete of AV/EDR Product Files (locked: unlock with TL Creds)
- SilverFox ValleyRAT — VM/Sandbox Evasion Probe Prior to C2 Beacon (locked: unlock with TL Creds)
- SilverFox ValleyRAT — Trojanized Installer DLL Side-Loading (locked: unlock with TL Creds)
- SilverFox ValleyRAT — WebSocket/QUIC C2 Beaconing to Known Domains (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- Domain: `3w[.]jxuw3[.]com`
- File hash: `520304a1cabdd9aa05c0a769c3874bc3cc2608d8e71ae607ca2bdf96b298b5de`
- Domain: `df[.]sjickdeh[.]org`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in Live ValleyRAT Campaign](https://cybersecuritynews.com/silverfox-hackers-use-go-rat-av-killer/)
- [SilverFox Campaign Turns ValleyRAT Into Multi-Stage Malware With Rootkit Capabilities](https://gbhackers.com/silverfox-expands-valleyrat-attack/)
- [SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in ValleyRAT Campaign](https://securityboulevard.com/2026/07/silverfox-hackers-use-go-rat-av-killer-and-kernel-rootkit-in-valleyrat-campaign/)
- [SilverFox ValleyRAT Campaign Uses Eight-Stage Chain to Deploy Kernel Rootkit](https://cyberpress.org/silverfox-deploys-kernel-rootkit/)
- [Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits](https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/)
- [ValleyRAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat)
- [Silver Fox's Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack](https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/)
- [Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit](https://thehackernews.com/2025/06/chinese-group-silver-fox-uses-fake.html)
- [Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware](https://thehackernews.com/2025/09/silver-fox-exploits-microsoft-signed.html)
- [Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware](https://thehackernews.com/2025/12/silver-fox-targets-indian-users-with.html)
- [Silver Fox Expands Asia Cyber Campaign with AtlasCross RAT and Fake Domains](https://thehackernews.com/2026/03/silver-fox-expands-asia-cyber-campaign.html)
- [China-based Silver Fox spoofs healthcare app to deliver malware](https://www.helpnetsecurity.com/2025/02/25/china-based-silver-fox-spoofs-healthcare-apps-dicom-viewer-to-deliver-valleyrat-malware/)
- [Inside Silver Fox's Den: Trustwave SpiderLabs Unmasks a Global Threat Actor](https://www.trustwave.com/en-us/resources/blogs/trustwave-blog/inside-silver-foxs-den-trustwave-spiderlabs-unmasks-a-global-threat-actor/)
- [APT Profile - Silver Fox - CYFIRMA](https://www.cyfirma.com/research/apt-profile-silver-fox/)
- [Silver Fox APT Blurs the Line of Espionage & Cybercrime](https://www.darkreading.com/threat-intelligence/silver-fox-apt-espionage-cybercrime)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1194