Beyond ValleyRAT: inside a China-nexus Silver Fox operation 

Threat researchBeyond ValleyRAT: inside a China-nexus Silver Fox operationHasan Mevzi VMRay LabsNovember 10, 2026 · 20 min read1. Executive summaryWe investigated an operation, seen from August to October 2026, that spread the Windows backdoor ValleyRAT. We analysed 44 loader builds and decrypted every configuration. Twenty-five, which call five command and control (C2) servers, make upVMRayRead More