An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

Reported 01 Jul 2026 by otx · Severity: medium

LevelBlue has identified two distinct ValleyRAT attack vectors: campaigns using fake installers and malicious email-based campaigns. Detection volume increased significantly from May 2025, nearly doubling in 2026. The fake installer attacks primarily target Chinese-speaking users