Silver Fox Strikes Again: Fake Telegram Language Pack Spreads ValleyRAT Backdoor in Sophisticated Cyberattack

Introduction: A Deceptive Download with Dangerous Consequences

On April 8, 2026, cybersecurity researchers uncovered a highly sophisticated malware campaign tied to a Chinese-linked hacking group known as Silver Fox hacking group. Disguised as something as harmless as a language update for Telegram, this attack highlights how even routine downloads can become entry points for serious system compromise. Behind the scenes, attackers deploy a powerful backdoor called ValleyRAT, combining stealth, technical precision, and clever evasion tactics to gain full control of infected machines.

Summary of the Attack Campaign

The infection chain begins with a malicious installer masquerading as a Chinese language pack for Telegram. Unsuspecting users download and execute the file, believing it to be a legitimate update. Once launched, the installer silently extracts three concealed components using a rarely used compression tool called zpaqfranz. This choice is intentional, as most antivirus systems are not optimized to scan such uncommon archive formats, allowing the malware to slip through undetected.

After extraction, the malware performs an environment check, scanning for widely used Chinese antivirus software. If such programs are detected, the attack adapts. It deploys a legitimate, digitally signed application developed by ByteDance, using it as a disguise. Because the program is trusted by security systems, it acts as a shield, enabling malicious components to execute in the background without raising alarms.

The final stage of the infection involves establishing communication with a remote command-and-control server located in Hong Kong. This connection grants attackers full remote access to the compromised system. To maintain the illusion of legitimacy, the installer completes its process by actually applying the Chinese language pack to Telegram, leaving users unaware that anything malicious has occurred.

Once active, the ValleyRAT backdoor escalates its capabilities by installing a vulnerable driver originally associated with Wincor Nixdorf systems. This step allows the malware to gain kernel-level access, effectively bypassing system defenses and embedding itself deeply within the operating system. From this privileged position, it can disable security tools, manipulate memory, and remain persistent without detection.

Security researchers traced the infrastructure behind the attack to a bulletproof hosting network frequently used by the Silver Fox group. Known for blending financial cybercrime with espionage activities, the group has a history of distributing trojanized versions of widely used software such as Zoom, WinSCP, and Microsoft Teams. In this campaign, they included a tracking identifier labeled “King-New” within the malware code, likely used to manage and categorize their operations internally.

Experts recommend immediate defensive actions, including blocking the identified command-and-control server and monitoring systems for unusual execution of the zpaqfranz tool. The campaign serves as a reminder that attackers continue to evolve, leveraging trust, rarity, and technical loopholes to stay ahead of traditional security measures.

What Undercode Say: The Real Threat Lies in Trust Exploitation

The most striking aspect of this campaign is not just its technical sophistication, but its psychological precision. Attackers are no longer relying solely on exploits or brute force. Instead, they exploit user trust at multiple levels. By disguising malware as a Telegram language pack, they target a routine user behavior: installing updates or enhancements. This is where modern cyberattacks are becoming more dangerous, because they blend seamlessly into normal digital habits.

Another key insight is the deliberate use of uncommon tools like zpaqfranz. Most security solutions are trained to detect widely used compression formats such as ZIP or RAR. By stepping outside these norms, attackers effectively create blind spots in detection systems. This indicates a shift toward “evasion by obscurity,” where rarity itself becomes a weapon.

The use of legitimate software signed by ByteDance is equally significant. This technique, often referred to as “living off the land,” shows how attackers weaponize trust in established companies. Instead of breaking security systems directly, they manipulate them into allowing malicious actions. This approach is particularly effective because it bypasses one of the core assumptions of cybersecurity: that signed software is safe.

Kernel-level exploitation through vulnerable drivers marks another escalation. Once malware reaches this depth, traditional antivirus tools become almost irrelevant. At this level, attackers can control system processes, hide their presence, and even interfere with forensic analysis. This raises serious concerns about the long-term persistence of such threats, especially in enterprise environments.

The attribution to Silver Fox also matters. This group has consistently blurred the line between cybercrime and state-aligned operations. Their campaigns are not random; they are strategic, targeted, and often designed for both financial gain and intelligence gathering. The inclusion of tracking tags like “King-New” suggests a level of operational maturity similar to professional software development teams.

From a defensive perspective, this attack reinforces the importance of behavioral monitoring over signature-based detection. Organizations must move toward systems that analyze anomalies, such as unusual tool execution or unexpected network connections, rather than relying solely on known malware signatures.

Finally, this campaign underscores a broader trend: attackers are investing more in stealth than in speed. Instead of loud, destructive attacks, they prefer quiet, persistent access. This makes detection harder and increases the potential damage over time. The real danger is not the initial infection, but how long the attacker can remain undetected within the system.

Fact Checker Results

✅ The Silver Fox group is widely associated with both cybercrime and espionage-linked operations.
✅ Using legitimate signed software to evade detection is a well-documented attacker technique.
❌ No public evidence confirms the exact scale of infections in this specific campaign yet.

Prediction

🔮 Expect more malware campaigns to use niche tools and uncommon file formats to bypass detection systems.
🔮 Trust-based attacks involving legitimate signed applications will become increasingly common.
🔮 Kernel-level exploits will rise, forcing security vendors to rethink traditional endpoint protection strategies.