Winos

Winos, also referred to as WinOS and sometimes ValleyRAT in reporting on related campaigns, is a modular Windows remote-access trojan and backdoor framework used extensively in Chinese-speaking cybercrime and intrusion ecosystems. It has been associated with campaigns attributed to Silver Fox and other China-linked operators, and it has also appeared in activity tied to distributor-style malware delivery networks and gambling-focused threat clusters. The malware is commonly delivered through trojanized software installers, including MSI and EXE packages masquerading as popular consumer applications, translation tools, browsers, VPN software, office software, and fake Flash updates. Distribution has also been observed via SEO poisoning, counterfeit download portals, watering-hole style sites, and Telegram-based lure channels.

Winos is designed for full remote control of compromised Windows systems. Reported capabilities include command execution, remote shell access, file management, screenshot capture, webcam and microphone access, clipboard monitoring, keylogging, process and service management, plugin loading, and broader post-compromise surveillance and data theft. Some variants and plugin sets also support internal network scanning, privilege escalation, scheduled-task creation, startup persistence, process injection, and anti-analysis or anti-debugging checks. The framework has been described as plugin-based, with both internal and external modules enabling operators to extend functionality after initial compromise.

Observed infection chains typically use backdoored installers that deploy legitimate decoy software while silently launching staged malware components that establish persistence and ultimately load the Winos implant. Persistence mechanisms reported in Winos delivery chains include scheduled tasks, Windows services, Run-key style autoruns, and shortcut-based startup techniques. Operators have also used firewall-rule manipulation, port forwarding, and defense-evasion measures to maintain access and reduce detection.

Winos has been repeatedly used against Chinese-speaking users and has appeared in campaigns targeting sectors including gambling, technology, education, state-affiliated organizations, and other enterprises. Reporting indicates that leaked or reused code has contributed to broader adoption of the malware family beyond a single actor, making Winos a recurring component in multiple intrusion sets that rely on fake software distribution and social-engineering-heavy initial access.