Operation Silk Lure: Weaponizing Windows Scheduled Tasks for ValleyRAT Delivery
A targeted cyber-espionage campaign has been identified, exploiting Windows Scheduled Tasks and DLL side-loading to deploy the ValleyRAT backdoor. This operation primarily affects Chinese FinTech and cryptocurrency firms through a series of sophisticated…
A targeted cyber-espionage campaign has been identified, exploiting Windows Scheduled Tasks and DLL side-loading to deploy the ValleyRAT backdoor. This operation primarily affects Chinese FinTech and cryptocurrency firms through a series of sophisticated tactics.
The campaign employs spear-phishing emails, weaponized Windows shortcuts, and a persistent task scheduler mechanism to deliver a multi-stage malware payload. These emails, crafted to appear as job applications, target HR and technical teams. Each email includes a malicious .LNK shortcut embedded in a seemingly legitimate résumé PDF. Seqrite Lab researchers have uncovered the operation, which reveals its command and control (C2) server at 206.119.175.16 and initiates the ValleyRAT backdoor.
The decoy résumé is written in Simplified Chinese, presenting a profile for 李汉兵 (Li Hanbing), a senior full-stack engineer. This detailed profile includes credentials such as a degree from South China Agricultural University and work history at notable tech firms, enhancing its authenticity.
Upon execution of the .LNK file, a PowerShell one-liner is triggered, reaching out to pan.tenire.com in the United States to download key artifacts such as keytool.exe , CreateHiddenTask.vbs , jli.dll , and a decoy PDF. These files are placed in the %APPDATA%\Security directory, initiating the next stage of the attack.
A targeted cyber-espionage campaign has been identified, exploiting Windows Scheduled Tasks and DLL side-loading to deploy the ValleyRAT backdoor.
Persistence is maintained through a VBScript ( CreateHiddenTask.vbs ) that registers a daily scheduled task named “Security.” This task executes keytool.exe at 8:00 AM, appearing as a Microsoft-signed process. The script self-deletes after registering the task to remove forensic evidence.
At runtime, keytool.exe side-loads jli.dll , decrypting an RC4-encrypted payload with a fixed key in memory, executing it directly without disk writes.
The second-stage payload, ValleyRAT, conducts extensive reconnaissance, collecting system and network information, and executes measures to evade virtual environments and disable antivirus software.
Operation Silk Lure employs advanced techniques to infiltrate targeted enterprises. Organizations should monitor for indicators such as DNS queries to pan.tenire.com , scheduled tasks named “Security,” and unusual PowerShell activity. Implementing application whitelisting, monitoring unexpected scheduled tasks, and blocking access to identified C2 infrastructure can help mitigate these threats.
Based on reporting by GBHackers.