Analysis of 44 loader builds traces the operation to one domain registrar account, and shows why look-alike builds from a public malware builder say little about who is behind them.
BOCHUM, Germany, November 12, 2026. VMRay Labs has published its analysis of an operation that spread the Windows backdoor ValleyRAT from August to October 2026. The researchers analyzed 44 loader builds and decrypted the configuration of every one. Twenty-five of those builds, which call five command-and-control (C2) servers, make up the operation.
VMRay Labs judges it very likely, with moderate confidence, that the operation belongs to Silver Fox ValleyRAT activity, the cluster that security vendors track as Silver Fox and place in China. The report names no actor, team or sponsor within that cluster.
What the research shows
- Delivery through trusted software. In the August and September packages examined, a genuine signed program, usually renamed with a tax number, side-loads an unsigned loader from a disk image. One program name refers to CERT-In, India’s computer emergency response team. The loader downloads the ValleyRAT core, keeps it in the Windows registry and persists through a scheduled task.
- One registrar account connects the pieces. A single customer account at the registrar Gname registered 243 domains. They include Indian tax lure domains that CloudSEK published and two domains named in Silver Fox reporting by Sekoia and JUMPSEC. Two observations tie that account to the file-sharing site that delivered three of the operation’s builds: an IP address shared on one day, and a link from one tax lure page.
- One delivery host, three C2 servers. The same file-sharing site served loaders for three C2 servers, one after another. The report states both readings of that evidence: a single operator, or a delivery service with several customers.
- Look-alike builds prove little. The ValleyRAT builder has been public since March 2025. Six of the builds were compiled in the same second on 19 August 2026 and still call five different C2 servers. The configuration inside each build, and the registration records behind its servers, are what tell operators apart.
- A government seal nobody sees. Twelve builds carry the seal of the U.S. Department of Homeland Security as their main icon. It is the icon of a blank Spanish-language template program in which the kit hides its code, and the loader never displays it. VMRay Labs found 170 files carrying the same icon on 14 October. The seal’s presence implies no involvement or endorsement by DHS.
- Every configuration can be decrypted offline. Each build carries its own key in a predictable form, so defenders holding an unpacked build can read its configuration without running it. Captured C2 traffic decrypts too.
How far the attribution goes
The report uses “China-nexus” to mean very likely run from a Chinese-speaking environment in a UTC+8 time zone, judging by package time stamps in weekday office hours, the signed programs chosen and the domain registrations. The term makes no claim of state direction. Nothing in the evidence separates crime from espionage, and every judgment in the report carries a stated likelihood and confidence level.
“Six of the builds we analyzed were compiled in the same second and call five different servers,” said Hasan Mevzi, threat researcher at VMRay Labs. “With a public builder, code that looks the same tells you little about who is behind it. The configurations and the registration records did that work, and where the evidence is thin we say so.”
What defenders can do now
- Block the indicators the file marks as safe to block, and match the dated ones only within their observation dates, because those servers are rented or shared.
- Hunt for unsigned DLLs beside signed programs that run from a mounted disk image or under a tax document name. Do not block the signed programs themselves; they are legitimate vendor files.
- Hunt for the registry value and scheduled task listed in the indicator file, and rebuild any host that holds them. The backdoor gives remote control, and the August builds carry kernel drivers.
Availability
The research began with a single file from the VMRay UniqueSignal threat intelligence feed. The full report, the technical annex and all 1,391 indicators are public under TLP:CLEAR:
Questions and answers
These differ on purpose from the FAQ on the report page, so the two FAQ blocks do not duplicate each other.
Is the U.S. Department of Homeland Security involved or being impersonated? No. The seal is the icon of an empty template program inside the malware file. The loader never shows it, and VMRay Labs rates a victim-facing purpose as very unlikely on the delivery paths it observed.
Is this a state-sponsored operation? The report makes no such claim. It places the operation in a Chinese-speaking environment and finds nothing that points to state tasking.
Who was targeted? The report identifies no victims. Package names and lure pages suggest that some tax-themed packages were aimed at people in India, a judgment VMRay Labs holds with low confidence.
What is new compared with earlier Silver Fox research? The registrar account that links Indian tax lures to domains in earlier Silver Fox reports, the delivery host that served three C2 servers in turn, the seal icon, and the finding that every configuration and all captured traffic can be decrypted offline.
About VMRay
VMRay helps security teams detect and analyze novel, evasive and targeted malware and phishing threats. Its hypervisor-based sandbox observes what a threat does and returns clear verdicts, reports and indicators that analysts and automated workflows can act on. VMRay is headquartered in Bochum, Germany. www.vmray.com
Media contact:
Fatih Cam, Corporate Communications & Brand Manager, VMRay
fcam@vmray.com
