A new outbreak of attacks leverages the ValleyRAT_S2 malware to discreetly infiltrate organizations, remain undetectable for long periods of time, and exfiltrate sensitive financial data.
See also: MuddyWater uses malicious Word documents to distribute RustyWater
ValleyRAT_S2 a full-fledged remote access tool (RAT), providing attackers with extensive control over infected systems and efficient data extraction mechanisms.
The current campaign is primarily spread through fake Chinese-language productivity tools, pirated software, and altered installers masquerading as AI spreadsheet applications. In many cases, the malicious payload is delivered via DLL side-loading, where a legitimately signed application is tricked into loading a malicious DLL with a name that resembles a legitimate library, such as steam_api64.dll.
After analyzing and monitoring these attacks, APOPHiS identified ValleyRAT_S2 as the primary second-stage backdoor driving these infiltrations.
See also: Fake WinRAR sites distribute Winzipper malware
Malware is also distributed via attachments in targeted spear phishing attacks, as well as through compromised software update channels.
Malicious documents and compressed files drop their attack payloads into system directories, such as the Temp, for example:C:\Users\Admin\AppData\Local\Temp\AI电话大全官网视频制分类型安全发动分类型安全发动分\steam_api64.dll.
Stage 1 then focuses on evading detection, while ValleyRAT_S2 takes on long-term access persistence, system identification, credential stealing , and financial data collection. Once activated, ValleyRAT_S2 examines active processes, the file system, and registry keys, and then communicates with predefined command and control (C2) servers, such as 27.124.3.175:14852 , via a custom TCP protocol.
The malware has capabilities to upload and download files, execute shell commands, inject malicious payloads, and record keystrokes.
See also: Phishing emails mimic DocuSign to distribute malware
These capabilities make it particularly effective for extracting online banking credentials, payment data, and internal financial documents.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
