Operation Silk Lure: Weaponizing Windows Scheduled Tasks for ValleyRAT Delivery

Operation Silk Lure describes a targeted cyber-espionage campaign that uses Windows Scheduled Tasks and DLL side-loading to deploy ValleyRAT, with Seqrite Lab researchers having uncovered its operations and revealing the C2 server at 206.119.175[.]16.

The attackers rely on spear-phishing emails containing a malicious .LNK shortcut embedded in a seemingly legitimate résumé PDF, and the initial PowerShell one-liner contacts pan.tenire[.]com in the United States to fetch artifacts such as keytool.exe, CreateHiddenTask.vbs, and jli.dll, dropping them in %APPDATA%\Security to begin the attack.

Persistence is achieved via a VBScript that registers a daily scheduled task named “Security,” which runs keytool.exe each day at 8:00 AM and then self-deletes to conceal traces. ValleyRAT’s second stage reads an RC4-encrypted payload from its own PE sections, using a fixed key “123cba” for in-memory decryption, and exfiltrates data while probing for antivirus products and sandbox environments.

The operation targets Chinese FinTech and cryptocurrency firms, with the exfiltration infrastructure spanning more than 20 domains under a .work TLD cluster associated with SonderCloud Limited, Hong Kong. According to Seqrite Lab, the decoy résumé is written in Simplified Chinese to mirror a profile for 李汉兵, a senior engineer, enhancing the lure.