Threats Tagged 'donut shellcode'

ValleyRAT malware campaigns have been identified using two main infection vectors: fake installers targeting Chinese-speaking users and malicious email campaigns targeting both Chinese and Japanese-speaking users. The malware employs advanced evasion techniques such as process injection, DLL sideloading, junk code insertion, memory and process checks, and fileless execution via Donut-generated shellcode. It establishes persistence through registry modifications and enables remote access for attackers. Detection volumes have increased significantly since May 2025, nearly doubling in 2026. No specific software versions are affected, and no official patches or fixes are available.