Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits

According to Check Point Research, ValleyRAT backdoor, also known as Winos or Winos4.0, is dissected as a modular system with a Driver Plugin that embeds a kernel‑mode rootkit. The analysis shows the rootkit driver remains loadable on fully updated Windows 11 systems, aided by a signed but expired certificate, and a driver installation sequence can run in Normal or Stealth mode using MalSeclogon impersonation to disrupt network connectivity during installation.

Researchers found roughly 6,000 ValleyRAT samples in the wild between November 2024 and November 2025, with around 85% of detections in the last six months, coinciding with the builder’s public appearance; they also identify 30 distinct builder variants and 12 rootkit driver variants. The ValleyRAT builder/public repositories surfaced in March 2025, with the builder PE compiled on 26 March 2025 and an effective date claim of 25 March 2025.

The study notes several in‑the‑wild samples were signed with valid certificates, complicating attribution and enabling persistence on modern Windows versions.