ValleyRAT Malware Evades Windows 11 Security with Stealthy Driver Install
Check Point Research (CPR) has conducted an analysis of ValleyRAT, a backdoor known for its sophisticated modular architecture and kernel-mode rootkit capabilities. This analysis reveals the malware's ability to bypass modern security measures on Windows…
Check Point Research (CPR) has conducted an analysis of ValleyRAT, a backdoor known for its sophisticated modular architecture and kernel-mode rootkit capabilities. This analysis reveals the malware's ability to bypass modern security measures on Windows 11 systems.
The research highlights ValleyRAT's "Driver Plugin," which includes a kernel-mode rootkit signed with certificates that are expired but still valid under Microsoft's legacy driver signing policy. This allows the rootkit to load on Windows 11 systems with protections like Hypervisor-protected Code Integrity (HVCI) and Secure Boot enabled.
The rootkit's original Program Database (PDB) path and compilation timestamp from April 23, 2023, suggest that the developers utilized the publicly available "Hidden" rootkit project. Approximately 25 new functions have been added to the original codebase to enhance stealth and lateral movement.
ValleyRAT employs two driver installation modes. The normal mode installs the embedded driver as a kernel service named "kernelquick." The "Driver Plugin" operates as a user-mode client for the rootkit driver, with its original filename recoverable from the Export Directory.
In "Stealth Mode," MalSeclogon-based impersonation and parent process ID (PPID) spoofing are used to execute installation commands, reducing detection signals. The rootkit driver includes advanced functions for persistence and detection evasion, such as UMInjection() for shellcode injection and ForceDeleteFile() for kernel-level file deletion, including antivirus and EDR drivers.
This analysis reveals the malware's ability to bypass modern security measures on Windows 11 systems.
The SetDriverStartType_SystemStart() function enhances persistence by setting the service start type to system startup.
Approximately 6,000 ValleyRAT-related samples were detected between November 2024 and November 2025, with a significant increase following the public release of the ValleyRAT builder in March 2025. This release included GitHub repositories containing the C2 panel and development structure.
Researchers identified 30 builder variants and 12 rootkit driver variants, mostly compiled in 2025. Some drivers were signed with non-revoked certificates from before 2015, highlighting gaps in driver blocklists and detection capabilities.
ValleyRAT's 19 main plugins offer extensive backdoor functionalities, including system reconnaissance, file management, remote command execution, and surveillance. Additionally, 24 auxiliary plugins target credential theft and data exfiltration, specifically targeting applications like WeChat, QQ, and Telegram.
The public availability of the builder and source code complicates attribution efforts. Previously linked to Chinese-speaking threat actors, ValleyRAT can now be independently compiled and deployed by any user.
Check Point has reported these findings to Microsoft's Security Intelligence team, emphasizing real-world security vulnerabilities in Windows driver signing policies. The research indicates a shift from an actor-linked threat to a widely available malware framework, with increasing adoption in the wild.
Based on reporting by GBHackers.