MalwarePublished 16 Oct 2025Updated 15 Nov 2025

Operation Silk Lure: Scheduled Tasks Weaponized for DLL Side-Loading (drops ValleyRAT)

Source AlienVault OTX General

Description

A sophisticated cyber campaign targeting Chinese individuals in the FinTech, cryptocurrency exchange, and trading platform sectors has been uncovered. The operation uses spear-phishing emails with malicious .LNK files embedded in fake resumes. When executed, these files initiate a multi-stage infection process, ultimately deploying ValleyRAT malware. The malware establishes persistence through scheduled tasks, performs system reconnaissance, and exfiltrates sensitive data. The campaign's infrastructure is primarily hosted in Hong Kong, with multiple domains using the .work TLD to impersonate job portals. The attackers employ various techniques to evade detection, including anti-VM checks and attempts to disable antivirus software.

Impact

For European organizations, the direct impact of Operation Silk Lure is currently limited due to its targeting of Chinese individuals in specific sectors. However, European FinTech and cryptocurrency firms with business ties to China or employing Chinese nationals could be at risk. If the campaign expands or variants emerge, the use of DLL side-loading and scheduled tasks for persistence could allow attackers to maintain long-term access, leading to data breaches, intellectual property theft, and disruption of critical financial operations. The malware’s capability to disable antivirus and evade VM detection increases the risk of prolonged undetected compromise. Exfiltration of sensitive financial and personal data could result in regulatory penalties under GDPR, reputational damage, and financial losses. Additionally, the use of spear-phishing with social engineering tactics highlights the risk to employees who may be targeted with convincing fake job offers or resumes, potentially leading to broader infection within European organizations.

Defensive guidance

European organizations, especially those in FinTech and cryptocurrency sectors, should implement targeted defenses against spear-phishing, including advanced email filtering and user awareness training focused on identifying malicious attachments like .LNK files. Endpoint detection and response (EDR) solutions should be configured to monitor and alert on suspicious scheduled task creation and DLL side-loading behaviors. Application whitelisting can prevent unauthorized DLLs from loading. Regular audits of scheduled tasks and system DLLs should be conducted to detect anomalies. Network monitoring should include detection of communications to suspicious domains, particularly those using uncommon TLDs like .work, and known malicious IP addresses associated with this campaign. Employing sandboxing technologies that can bypass anti-VM checks will improve detection of such malware. Additionally, restricting execution of shortcut files from email attachments and disabling unnecessary scheduled tasks can reduce attack surface. Incident response plans should include procedures for rapid containment and forensic analysis if infection is suspected. Collaboration with threat intelligence sharing groups can provide timely updates on emerging indicators and tactics.

Indicators of compromise

Domains 1

pan.tenire.com

IP addresses 4

206.119.175.16
206.119.175.162
206.119.175.178
206.119.175.65

Hashes 13

3ca440a3f4800090ee691e037a9ce501
6ea9555f1874d13246726579263161e8
83b341a1caab40ad1e7adb9fb4a8b911
e94e7b953e67cc7f080b83d3a1cdcb1f
f5b9ad341ccfe06352b8818b90b2413e
1b3a15955779e11424698f67bd305e15f6750fca
3177fe43cdaa6c519d47a9225735e4e503901576
74add8e181ad365e7e2e16317b61dc19e6a78480
9ab44514add105acdb17e298744d6a3124ee490d
190d493255c71f3cebb968c197aeef67c62d597b488c4a0b8cd77751e5999b94

Community reviews

Loading reviews…