# The Backdoor You Let In Yourself: How Silver Fox Weaponized Your AV Exclusion List
Most malware campaigns fail on delivery. Silver Fox's latest doesn't — because it convinced you to do the whitelisting.
Kaspersky researchers have documented a campaign in which the Chinese-linked threat actor Silver Fox distributed ValleyRAT — a persistent, full-featured backdoor — wrapped inside QN Wallpaper, a legitimate, digitally-signed desktop customization utility popular in Chinese-speaking markets. The twist that makes this campaign genuinely alarming isn't the signing itself. It's what happens next: users routinely flag adware-adjacent tools like QN Wallpaper in their antivirus as false positives, manually adding them to exclusion lists. Silver Fox built its entire evasion strategy around that habit.
## Trust You Manufactured Yourself
Digital signatures have always been an imperfect proxy for safety. Threat actors have been abusing legitimate certificates for years — ShadowPad operators embedded backdoors in signed software from nine different vendors going back to 2017. But what Silver Fox is pulling off here is a layer beyond that.
The attack doesn't just rely on a trusted certificate. It relies on the user's own security decisions actively neutralizing their defenses. QN Wallpaper is the kind of program that antivirus engines sometimes flag because it touches desktop rendering, makes network calls for wallpaper updates, and behaves in ways that look suspicious at surface level. A user who downloads it, sees an AV alert, and decides "this is a false positive" — adding it to their exclusion list — has just handed Silver Fox a persistent, invisible execution environment.
ValleyRAT runs underneath the QN Wallpaper process. From the endpoint's perspective, everything is clean. The parent process is signed. The user blessed it. There's nothing left to flag.
This is social engineering baked into the delivery mechanism itself, with no phishing email required.
## Silver Fox's Target Profile
Silver Fox isn't a ransomware crew burning everything to the ground. The group has historically shown patience and precision — prior campaigns used fake Notepad++ and Chrome installers to target finance and pharmaceutical organizations, predominantly in Chinese-speaking geographies. ValleyRAT reflects that operational posture. The backdoor offers full remote control, keylogging, credential harvesting, and plugin-based extensibility. You don't build a payload like that for smash-and-grab operations. You build it to stay.
The choice of QN Wallpaper as a trojan is telling. It's a niche enough tool that most Western corporate environments would never encounter it, but credible enough that target users — likely Chinese-speaking professionals, mainland users, or diaspora communities — would recognize and trust the name. The disguise was chosen for a specific audience.
## Why This Is Harder to Detect Than It Looks
Security teams running behavior-based detection still have a shot here, but the attack stacks odds against them in specific ways:
Network monitoring and EDR telemetry focused on behavioral baselines — not just signature matching — are your primary detection surface. Look for wallpaper applications establishing unexpected outbound connections, spawning shells, or touching credential stores.
## HackWire Analysis
Silver Fox's QN Wallpaper campaign is a case study in what I'd call trust laundering — taking a legitimate object (a signed app), running it through the user's own decision-making process (AV exclusion), and emerging on the other side of every security control in the environment. It's not novel in concept, but the execution here is unusually clean.
What other coverage is missing: this campaign signals a maturation in Silver Fox's delivery doctrine. Earlier campaigns used fake installers — convincing but ultimately detectable once your threat intel caught up. Trojanizing a real, working application that users actively choose to run changes the game. The software does what it says on the tin. Users get their wallpapers. The backdoor gets its persistence. No one is immediately suspicious.
This also maps onto a broader 2024-2026 trend worth watching: threat actors moving away from credential-phishing lures (which burn fast when awareness is high) toward embedding in software workflows that victims manage themselves. Living-off-the-land using legitimate binaries was phase one. Living-off-the-user's-exclusion-list is phase two.
For defenders, the immediate lesson isn't "ban all desktop customization tools." It's simpler: audit your exclusion lists. In most organizations, AV exclusions accumulate over years without review. Silver Fox is betting that they do. A quarterly review of endpoint exclusions — cross-referenced against current threat intelligence on abused software — is a cheap control with outsized return right now.
For organizations with Chinese-speaking employee populations or significant operations in Chinese-speaking markets, this campaign specifically warrants a closer look at software in those environments that may be excluded from standard software inventories and security baselines.
The most dangerous security gap isn't the one attackers find. It's the one your own team politely set aside.
— HackWire Editorial
---