CybersecurityMalware & Ransomware

Counterfeit Chrome Sites Spread ValleyRAT Malware Through DLL Hijacking

Analyst 207|
Counterfeit Chrome Sites Spread ValleyRAT Malware Through DLL Hijacking

Counterfeit Chrome Sites Spread ValleyRAT Malware

Counterfeit Chrome Sites Spread ValleyRAT Malware Through DLL Hijacking

In 2023, a new wave of cyber threats emerged as counterfeit websites masquerading as Google Chrome began distributing a remote access trojan (RAT) known as ValleyRAT. This malware is linked to a threat actor identified as Silver Fox, who has a history of targeting Chinese-speaking regions.

Overview of ValleyRAT

ValleyRAT is a sophisticated malware that allows attackers to gain unauthorized access to victims’ systems. The distribution method involves DLL hijacking, which exploits vulnerabilities in legitimate software installations.

Threat Actor: Silver Fox

The Silver Fox group has been active in various cyber campaigns, primarily focusing on:

  • Chinese-speaking regions, including Hong Kong, Taiwan, and Mainland China.
  • Targeting key roles within organizations to maximize impact.

Distribution Method

The counterfeit Chrome sites utilize the following tactics:

  • Creating fake websites that closely resemble the official Google Chrome site.
  • Offering malicious installers that appear legitimate to unsuspecting users.
  • Employing DLL hijacking techniques to execute the malware during installation.

Conclusion

The rise of ValleyRAT malware highlights the importance of vigilance when downloading software from the internet. Users are advised to verify the authenticity of websites and installers to protect against such threats.

Key Points

  • ValleyRAT malware is distributed through counterfeit Google Chrome sites.
  • Silver Fox is the threat actor behind this campaign, targeting Chinese-speaking regions.
  • DLL hijacking is a key method used to install the malware.
  • Users should exercise caution and verify sources before downloading software.
Cyber Threats
Related Intelligence

Continue Reading

A laptop sits open on a low table in a modern corporate office lobby.

Microsoft Warns of ACR Stealer Malware Surge Targeting Enterprise Customers

Microsoft warns of a surge in ACR Stealer malware attacks targeting enterprise customers, using clever social-engineering tactics and legitimate Windows tools to steal sensitive info. The malware, described as a malicious-as-a-service operation, has seen a significant spike in attacks between late April and mid-June.

Analyst 207
Smartphone on a neutral surface with blank screen and hint of a hand nearby.

Biometric Age Verification Shifts to On-Device Processing

With data breaches skyrocketing - a record 3,322 in the US last year alone - and over 30 age assurance laws now in force worldwide, the need for robust biometric age verification has never been more pressing. As governments crack down on underage access to social media, on-device processing is emerging as a crucial solution.

Analyst 207
Laptop on a minimalist desk with a potted plant and stack of paper in soft natural light.

WordPress Discloses Core Flaw Enabling Unauthenticated Code Execution

WordPress has patched a critical flaw that allowed hackers to execute code remotely without authentication, releasing versions 6.9.5 and 7.0.2 to fix the vulnerability. The update addresses a REST API batch-route confusion and SQL injection issue that could be triggered by a simple HTTP request.

Analyst 207
Rows of computer servers and networking equipment in a dimly lit data center with one server highlighted.

OpenSSL Flaw Exposes Servers to Memory Exhaustion Attacks

A newly discovered OpenSSL flaw, dubbed HollowByte, leaves unpatched servers vulnerable to memory exhaustion attacks, where a mere 11 bytes can trigger the allocation of up to 131 KB of memory for a message that never arrives. This tiny trigger can bring a server to its knees, freezing memory and blocking critical connections.

Analyst 207