ValleyRAT

In early November, Rapid7 Labs identified a new, highly evasive malware installer, 'CleverSoar,' targeting Chinese and Vietnamese-speaking victims.

本次攻击在溯源视角下呈现出通过微信等即时通讯途径投递的特点，且针对行业集中在证券、金融领域，该团伙的恶意样本最早于2021年5月活跃。

We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer (MSI) files in a recent campaign. These MSI f...

Technical analysis of a new ValleyRAT campaign | New updates include device fingerprinting and desktop screen capturing