Security researchers have uncovered a malware operation using counterfeit installers of popular applications like LetsVPN and QQ Browser to deliver the advanced Winos 4.0 framework. First detected by Rapid7 in February 2025, the campaign employs a memory-resident loader called Catena to evade traditional security measures.
“Catena uses embedded shellcode and configuration switching logic to stage payloads like Winos 4.0 entirely in memory, evading traditional antivirus tools,” explained researchers Anna Širokova and Ivan Feigl. “Once installed, it quietly connects to attacker-controlled servers – mostly hosted in Hong Kong – to receive follow-up instructions or additional malware.”
The attacks specifically target Chinese-speaking environments, demonstrating what researchers describe as “careful, long-term planning” by a sophisticated threat actor. Winos 4.0 (also known as ValleyRAT) was initially documented by Trend Micro in June 2024 and has been attributed to a threat group called Void Arachne or Silver Fox.
## Technical Details
The malware campaign utilizes NSIS installers bundled with signed decoy applications. The infection chain, dubbed Catena, employs several evasion techniques:
– Shellcode embedded in “.ini” files
– Reflective DLL injection for covert persistence
– Communication with command-and-control servers over TCP port 18856 and HTTPS port 443
– Scheduled tasks that execute weeks after initial compromise
In April 2025, researchers observed a tactical shift in the campaign. The updated attack sequence disguises itself as LetsVPN and runs PowerShell commands to add Microsoft Defender exclusions for all drives. It also checks for antivirus processes, particularly those related to 360 Total Security.
The malware uses binaries signed with an expired VeriSign certificate allegedly belonging to Tencent Technology (Shenzhen), valid from October 2018 to February 2020.
## Capabilities
Built upon the Gh0st RAT framework, Winos 4.0 is an advanced C++ malicious framework with plugin-based functionality that can:
– Harvest sensitive data
– Provide remote shell access
– Launch distributed denial-of-service (DDoS) attacks
Researchers conclude that this campaign represents “a well-organized, regionally focused malware operation” that heavily relies on memory-resident payloads and legitimate-appearing software to avoid detection, with infrastructure overlaps suggesting ties to the Silver Fox APT group.