Kaspersky Warns of ValleyRAT Spyware Campaign Across Asia
Dll Sideloading Exploited To Target Enterprise Systems
- Kaspersky uncovers a sophisticated ValleyRAT spyware campaign utilizing QN Wallpaper adware across Asia.
- The malware employs DLL sideloading under legitimate developer certificates to bypass security.
- The backdoor steals keystrokes, captures screenshots, controls system reboots, and deploys malicious module
Leading cybersecurity firm Kaspersky has issued a security advisory warning users across Asia regarding a sophisticated spyware campaign. Published on October 15, 2026, Kaspersky researchers uncovered a 'ValleyRAT' backdoor campaign exploiting QN Wallpaper adware to execute malware through DLL sideloading, disguised under a legitimate developer certificate.
According to Kaspersky cybersecurity experts, ValleyRAT is a highly sophisticated backdoor that covertly performs spyware functions, putting sensitive data belonging to both individual users and organizations at risk. The backdoor is capable of stealing sensitive data, including keystrokes and clipboard contents, capturing screenshots, controlling system shutdowns and reboots, and deploying additional malicious modules.
Vasily Kolesnikov, a cybersecurity expert at Kaspersky, noted that these attacks rely on the fact that legitimate applications sometimes fail to verify libraries loaded into their address space. This allows attackers to replace a legitimate library with a malicious one bearing the same name, which trusted applications load without raising suspicion, allowing the installation to go unnoticed. He emphasized that users often permit the installation of adware or unwanted software, which serves as an entry vector for malware, and urged users never to ignore antivirus warnings regarding unwanted software.
With a high degree of confidence, Kaspersky researchers attributed the campaign to SilverFox, a known operator of the malware family that targets organizations across multiple countries for both cyberespionage and financial gain.
To mitigate such cyber risks, Kaspersky recommends the following defensive measures:
- Avoid downloading software or files from untrusted sources.
- Never disable security tools or add suspicious applications to security exclusions.
- Organizations should establish clear third-party software policies.
- Educate employees on evolving cyber threats.
- Strengthen protection mechanisms with managed detection and response while monitoring credentials for signs of compromise. //DBTech/DADON/MVNO/MIST//
