Operation Silk Lure Weaponizing Windows Scheduled Tasks to Drop ValleyRAT
Operation Silk Lure is a recent campaign targeting Windows Task Scheduler to deploy a new variant of ValleyRAT. Active since mid-2025, it relies on spear-phishing emails with malicious LNK attachments, which appear as candidate resumes.
Operation Silk Lure is a recent campaign targeting Windows Task Scheduler to deploy a new variant of ValleyRAT. Active since mid-2025, it relies on spear-phishing emails with malicious LNK attachments, which appear as candidate resumes.
Upon opening the attachments, a hidden PowerShell command downloads a decoy document and two executables: a loader ( keytool.exe ) and a side-loaded DLL ( jli.dll ). The phishing scheme targets HR departments of Chinese fintech and trading firms. The LNK file contains an obfuscated PowerShell one-liner to silently retrieve payloads from a C2 server hosted in the United States.
The dropper writes a VBScript named CreateHiddenTask.vbs to the user's AppData folder to establish persistence by registering a daily scheduled task named "Security," spoofing Microsoft Corporation as the author. This task is registered programmatically and deletes itself to avoid detection.
The loader binary ( keytool.exe ) uses DLL side-loading to execute jli.dll , which locates an encrypted payload within the file and decrypts it using RC4 with a hard-coded key. The decrypted shellcode is injected into memory, initiating contact with the C2 server at 206.119.175.16 for reconnaissance and data exfiltration.
Operation Silk Lure is a recent campaign targeting Windows Task Scheduler to deploy a new variant of ValleyRAT.
ValleyRAT conducts extensive data harvesting and defense evasion, fingerprinting the host for CPU details, screen resolution, and NIC information, while checking for virtualization or known antivirus products through WMI queries. Security services such as 360Safe and Kingsoft have their network connections forcefully terminated. Activities are logged and transmitted over HTTPS, posing risks of credential theft and corporate espionage.
The infection chain exhibits a sophisticated persistence technique. The VBScript used to register the scheduled task leverages COM interfaces for interaction with the Task Scheduler. Below is a core snippet from CreateHiddenTask.vbs :
Set service = CreateObject("Schedule.Service") service.Connect Set rootFolder = service.GetFolder("\") Set taskDef = service.NewTask(0) With taskDef.RegistrationInfo .Author = "Microsoft Corporation" End With With taskDef.Triggers.Create(1) ' DAILY trigger .StartBoundary = "2025-08-01T08:00:01" .DaysInterval = 1 End With With taskDef.Actions.Create(0) ' EXEC action .Path = ExpandEnvironmentStrings("%APPDATA%\keytool.exe") End With rootFolder.RegisterTaskDefinition "Security", taskDef, 6, "", "", 3
The task executes keytool.exe every morning at 8:00 AM, ensuring consistent loader operation even after system reboots. Embedding author metadata and script deletion allows threat actors to blend into normal system activity, complicating forensic investigations.
The combination of LNK-based initial compromise, VBScript persistence, and DLL side-loading makes Operation Silk Lure a sophisticated threat requiring updated hunting signatures and vigilant monitoring of scheduled tasks.
Based on reporting by Cyber Security News.