MalwarePublished 10 Dec 2025

Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits

Source Check Point Research

Description

Highlights: Introduction Throughout 2025, we conducted and published several reports related to our research on the Silver Fox APT. In some of them (for example, here), the threat actor delivered the well-known ValleyRAT backdoor, also referred to as Winos or Winos4.0, as the final stage. Since this malware family is widely used, modular, and often associated with Chinese threat actors […] The post Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits appeared first on Check Point Research .

Impact

For European organizations, ValleyRAT poses a significant threat to confidentiality, integrity, and availability of critical systems. The malware's kernel rootkit capabilities allow it to evade traditional endpoint security solutions, making detection and removal challenging. Targeted organizations could suffer from espionage, intellectual property theft, disruption of operations, and potential sabotage. Sectors such as government, defense, telecommunications, energy, and high-tech manufacturing are particularly at risk due to their strategic importance and historical targeting by Chinese APT groups. The stealthy nature of the malware increases the risk of prolonged undetected presence, enabling extensive data exfiltration and lateral movement within networks. The lack of known active exploits in the wild does not diminish the threat, as the malware's modularity allows for rapid adaptation and deployment of new capabilities. European entities with extensive supply chain connections to Asia or those involved in geopolitical matters sensitive to Chinese interests may face elevated targeting likelihood.

Defensive guidance

European organizations should implement multi-layered defense strategies tailored to detect and mitigate kernel-level threats like ValleyRAT. Key recommendations include: 1) Deploy advanced endpoint detection and response (EDR) solutions capable of kernel-level monitoring and anomaly detection to identify rootkit behaviors. 2) Utilize kernel integrity verification tools to detect unauthorized modifications to kernel structures and drivers. 3) Enforce strict application whitelisting and code signing policies to prevent unauthorized execution of malicious binaries. 4) Segment networks to limit lateral movement and isolate critical assets. 5) Conduct regular threat hunting exercises focusing on indicators of kernel rootkit activity and unusual system calls. 6) Maintain up-to-date threat intelligence feeds to monitor developments related to ValleyRAT and associated APT groups. 7) Educate security teams on the specific tactics, techniques, and procedures (TTPs) used by Silver Fox and similar actors. 8) Implement robust incident response plans that include kernel-level malware remediation procedures. 9) Restrict administrative privileges and enforce least privilege principles to reduce the attack surface. 10) Collaborate with national cybersecurity centers and industry ISACs to share intelligence and coordinate defenses.

Summary

ValleyRAT, also known as Winos or Winos4.0, is a sophisticated modular backdoor malware family extensively used by Chinese APT groups, including Silver Fox. The malware operates as a final-stage payload, providing attackers with persistent remote access and control over compromised systems. Its modular design allows for flexible deployment of various capabilities, including data exfiltration, reconnaissance, and lateral movement. A notable advancement in this malware's evolution is the incorporation of kernel rootkits, which operate at the kernel level to hide the malware's presence, evade detection by security tools, and maintain persistence even after system reboots. The research highlights the exploitation of builder secrets, which are internal configurations or cryptographic keys used during malware compilation, enabling defenders to better understand and potentially disrupt the malware's deployment. Although no active exploits have been reported in the wild, the malware's association with state-sponsored actors and its technical sophistication underscore its threat potential. The malware does not require user interaction for execution and can compromise system confidentiality, integrity, and availability. The Check Point Research article provides an in-depth technical analysis of ValleyRAT's architecture, kernel rootkit mechanisms, and operational tactics, emphasizing the need for advanced detection and mitigation strategies.

References

research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Jan 2026, 16:18 UTC

References

Community reviews