ValleyRAT Backdoor Disguised as Signed QN Wallpaper Adware Evades Antivirus Defenses

According to Russian cybersecurity vendor Kaspersky, the threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application identified as QN Wallpaper. QN Wallpaper is a genuine desktop-wallpaper tool; however, the attackers have repurposed its signed binary to deliver the ValleyRAT malware. The backdoor executes under the trusted process signature of the adware, which allows it to slip past standard security controls. A significant vector for this evasion is user behavior: individuals who observe the signed application running often add it to their antivirus exclusion lists to prevent false positives. The threat actor exploits this common troubleshooting step, as the malware then operates under the trusted process, effectively bypassing the very defenses the user intended to protect. Kaspersky's analysis indicates this campaign has global distribution potential, leveraging the legitimacy of the QN Wallpaper signature to gain initial access and maintain a foothold on compromised systems. As of now, no official patch has been released by the QN Wallpaper developers, and the primary mitigation relies on user vigilance and security best practices regarding exclusions.