ValleyRAT

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Malware family tracked by Malpedia. ID: win.valley_rat

Threat Analysis

ValleyRAT is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning ValleyRAT

China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

The Hacker News· Jun 4, 2026

Silver Fox uses the new ABCDoor backdoor to target organizations in Russia and India

Securelist (Kaspersky)· Apr 30, 2026

Silver Fox Cyber Campaigns Show Shift Toward Dual Espionage

Infosecurity Magazine· Mar 24, 2026

External References

→https://any.run/malware-trends/valleyrat

→https://apophis133.medium.com/valleyrat-s2-chinese-campaign-4504b890f416

→https://hexastrike.com/resources/blog/threat-intelligence/valleyrat-exploiting-byovd-to-kill-endpoint-security/

→https://labs.k7computing.com/index.php/fake-microsoft-teams-campaign-delivers-valleyrat-via-nsis-installer-and-dll-sideloading/

→https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

ValleyRATWinoswin.valley_rat

External Intelligence

Malpedia: win.valley_rat

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search ValleyRAT