ValleyRAT Malware and the Evolving Landscape of Ransomware Threats 

As ransomware and remote access threats continue to evolve, Morphisec security researchers are closely tracking a new wave of sophisticated malware strains that blend stealth, persistence, and evasive delivery techniques. One such threat—ValleyRAT—has emerged as a compelling case study in how adversaries are refining their tactics to bypass traditional defenses and establish long-term footholds in target environments. 

Recently analyzed by threat researchers at Morphisec, ValleyRAT is attributed to the Silver Fox APT, a China-based threat group known for its use of Remote Access Trojans like Gh0stRAT. ValleyRAT represents a marked evolution in capabilities and tradecraft, with its operators targeting high-value sectors such as finance, healthcare, manufacturing, and critical infrastructure. 

The Rise of ValleyRAT: In-Memory Execution and Stealthy Persistence 

First identified in early 2023, ValleyRAT is a Remote Access Trojan that operates entirely in memory—a characteristic that makes it especially difficult to detect and remove. It leverages advanced techniques such as DLL side-loading, process injection, and living-off-the-land binaries (LOLBINs) like nslookup.exe to execute malicious code without writing it to disk. 

This approach allows the malware to bypass endpoint protection platforms and remain under the radar of many detection-based tools. In one observed campaign, attackers used nslookup.exe as a LOLBIN to trigger shellcode that decrypts an encrypted payload stored in mpclient.dat, executing it directly in memory. This multi-stage loading technique further complicates detection and response efforts. 

Evolving Delivery Infrastructure: Fake Sites, Familiar Tactics 

One of the most notable shifts in recent ValleyRAT activity is its use of legitimate-looking infrastructure to distribute malware. The threat actors behind it have repurposed a domain previously used to distribute Gh0stRAT, now presenting it as a fake Chrome installer site linked to a spoofed Chinese telecom company. 

This continuity gives the domain a false sense of legitimacy and may help it evade reputation-based blocking systems. By maintaining and reusing familiar infrastructure, the attackers build long-term credibility and increase their chances of success. 

Recent variants of ValleyRAT have expanded their capabilities, incorporating keylogging functionality—a feature not observed in earlier versions. The malware also now employs additional evasion and persistence techniques, including: 

• Registry modification 
• Process termination of security tools 
• DLL side-loading through popular Chinese applications, such as Douyin.exe (the Chinese version of TikTok) 

These enhancements reflect the group’s continued investment in making ValleyRAT more durable and effective in long-term espionage or intrusion campaigns. 

While attribution in cybersecurity is often complex, strong indicators suggest that the Silver Fox APT is behind ValleyRAT. These include: 

• The focus on Chinese-speaking victims 
• The use of shared infrastructure and code with Gh0stRAT 
• The sophistication of the malware’s delivery and evasion techniques 

Though it may seem counterintuitive for a Chinese APT to target Chinese-speaking users, this tactic may help the group test tools in low-risk environments, monitor dissidents, or blend into domestic cybercrime noise. 

Why Traditional Security Tools Are Falling Short 

The ValleyRAT campaign is a clear example of how traditional, detection-based security solutions are struggling to keep up. Tools that rely on static signatures, behavioral heuristics, or post-execution analysis are often blind to memory-resident threats and LOLBIN-based attacks that leave no trace on disk. 

Attackers are adapting faster than most defenses can respond—leveraging known binaries, disguising payloads as trusted applications, and evading detection with surgical precision. This shift in attacker behavior calls for a fundamental shift in how we think about ransomware defense. 

Why Preemptive Cyber Defense Is the Future of Ransomware Protection 

To effectively combat today’s advanced threats, organizations need to adopt a preemptive cyber defense model—a strategy built around stopping threats before they breach the system. 

Preemptive cyber defense, as defined by Morphisec, focuses on eliminating the attack surface through technologies like Automated Moving Target Defense (AMTD). Instead of chasing attackers with detection, AMTD changes the rules of engagement—by dynamically morphing memory structures and preventing the techniques attackers rely on, such as: 

• Process injection 
• DLL side-loading 
• Memory-based shellcode execution 

This proactive model neutralizes threats like ValleyRAT at runtime before they can do damage—without generating alerts that require triage or overwhelming SOC teams with false positives. 

More importantly, it removes the need to detect threats in order to defeat them. 

The Future of Ransomware — and Ransomware Defense 

ValleyRAT is more than just another malware strain—it’s a glimpse into the future of stealthy, persistent threats that blur the line between cybercrime and state-sponsored activity. Organizations must remain vigilant and move beyond reactive defense strategies. 

The future of ransomware defense lies in prevention-first strategies. By embracing preemptive cyber defense, security teams can finally turn the tables on attackers—securing critical infrastructure, reducing dwell time to zero, and making the attacker’s job exponentially harder. 

For further technical insights, read Morphisec’s full threat analysis: Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques 

To learn more about current ransomware trends and how you can defend against them, register for our upcoming webinar Cloudy With a Chance of Ransomware, hosted by Morphisec and the industry’s leading Cloud Detection & Response provider, Stream Security.  

ValleyRAT Indicators of Compromise (IOCs) 

Domains: 

• https://anizom[.]com/ 
• https://karlost[.]club/ 

Files: 

• sscronet.dll 
• douyin.exe 
• tier0.dll 
• mpclient.dat 

Hashes: 

• 53A6735CE1ECA68908C0367152A1F8F3CA62B801788CD104F53D037811284D71 (Setup.zip) 
• bb89e401560ba763d1c5860dd51667ba17768c04d00270bf34abebac47fd040e (tier0.dll) 

Suspicious behavior to monitor includes: 

• Process injection into svchost.exe 
• Unexpected use of nslookup.exe 

About the author

Alon Shekalim

Security Research Team Lead

Alon has been a member of the Morphisec research team since 2022 and last year moved into a leadership role as Morphisec’s Security Research Team Lead.