MalwarePublished 3 Dec 2025Updated 2 Jan 2026

ValleyRAT Campaign Targets Job Seekers, Abuses Foxit PDF Reader for DLL Side-loading

Source AlienVault OTX General

Description

A ValleyRAT campaign is targeting job seekers through email, disguising itself as a Foxit PDF reader and using DLL side-loading for initial system access. The campaign exploits job seekers' eagerness by using recruitment-related lures in archive files. The attack employs sophisticated techniques, including obfuscation through nested directories and execution via DLL sideloading. Once activated, ValleyRAT can lead to system control, activity monitoring, and data theft. The campaign's success is evident from a spike in ValleyRAT detections. It demonstrates the integration of social engineering, legitimate software abuse, and advanced malware techniques to exploit vulnerabilities in both systems and human psychology.

Impact

For European organizations, this campaign poses a significant risk of credential theft, unauthorized system access, and data exfiltration, especially within sectors with high employment turnover or active recruitment processes. Compromise of endpoints through DLL side-loading can lead to persistent access for attackers, enabling espionage or further lateral movement within networks. The use of social engineering targeting job seekers increases the likelihood of initial infection, potentially affecting HR departments and job applicants alike. Data theft could include personally identifiable information (PII), corporate confidential data, and intellectual property, leading to reputational damage and regulatory penalties under GDPR. The campaign's ability to evade detection by abusing legitimate software complicates incident response and increases remediation costs. Additionally, the medium severity rating suggests that while the threat is not immediately critical, it can escalate if combined with other attack vectors or if attackers gain deeper network footholds.

Defensive guidance

1. Conduct targeted user awareness training emphasizing the risks of recruitment-related phishing and the dangers of opening unsolicited archive files. 2. Implement application control policies that restrict execution of untrusted DLLs and monitor for DLL side-loading behaviors, particularly involving Foxit PDF Reader or similar applications. 3. Employ endpoint detection and response (EDR) solutions capable of detecting obfuscated files, nested archive structures, and suspicious process injections. 4. Regularly audit and restrict software installation privileges to prevent unauthorized software execution. 5. Monitor network traffic for unusual outbound connections indicative of remote access trojans. 6. Use threat intelligence feeds to update detection rules for ValleyRAT indicators and related TTPs. 7. Encourage use of multi-factor authentication (MFA) to limit attacker lateral movement post-compromise. 8. Maintain up-to-date software and security patches, even though no direct patch is available for this technique, to reduce overall attack surface. 9. Implement strict email filtering and sandboxing to detect and block malicious attachments exploiting social engineering. 10. Review and harden registry and startup folder permissions to prevent persistence mechanisms.

Indicators of compromise

IP addresses 2

154.90.58.164
196.251.86.145

Hashes 51

047ecfaf35b24ec74b523df17a745365
98aa859e129d590b94882a55e087c120
f30a849f5880243c48d13c76cfb6f227
fc54e0d16d9764783542f0146a98b300
0227738e5a98622ea88a2f09527618a6fc4b9be9
191a7e68ca0d15af4283844aa4916f8f73fe6be2
1c796a576e1f30ed0a672b30b0d2644aebe7f739
21f6eb9e582043af0be06dbdb2819e9642ca991a
2336179beb8a8d4c9a23771cc0ae31f2a146fbbd
2afde2c2a7773f68de691fe4f4e835fe530a3471

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Dec 2025, 11:00 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

IP addresses 2

Hashes 51

Community reviews

Related threats