Military-Grade ValleyRAT Goes Rogue: Kernel Rootkit Builder Leak Triggers Massive Global Surge

ValleyRAT, a sophisticated modular backdoor also known as Winos, has gone rogue after its builder was leaked online, prompting a massive surge in the threat landscape. According to CPR, the public release of the builder ended the exclusivity of ValleyRAT and made the weapon available to cybercriminals worldwide. The report notes a dramatic shift in the malware landscape, with approximately 85% of detected ValleyRAT samples appearing in the last six months, coinciding with the builder’s public release.

The kernel rootkit component, a driver plugin, is described as loadable on fully updated Windows 11 systems and capable of bypassing built-in protection features. Historically, ValleyRAT on networks pointed to Chinese-affiliated actors such as Silver Fox, though the public availability now blurs attribution. Check Point concludes that ValleyRAT has transitioned from a threat linked to specific actors to an openly available malware framework, potentially accelerating attacks across organisations.