Operation Silk Lure: Chinese Espionage Targets FinTech with Malicious Resume LNK to Implant ValleyRAT

Researchers at Seqrite Labs have uncovered Operation Silk Lure, a targeted cyber-espionage campaign aiming at Chinese FinTech and cryptocurrency firms with malicious resume LNKs that deploy a multi-stage payload. According to Seqrite Labs, the operation uses C2 infrastructure hosted in the United States to deliver modules that perform reconnaissance, credential theft, and data exfiltration, with the final payload being an evolved ValleyRAT.

The attack chain begins when a malicious .LNK file embedded in a resume is opened, triggering a PowerShell command of more than 260 characters that downloads additional components, including a decoy resumé PDF, keytool.exe, CreateHiddenTask.vbs and jli.dll, and then creates a daily scheduled task disguised as a Microsoft process to maintain persistence.

ValleyRAT’s capabilities include system fingerprinting, keylogging, and data exfiltration, while employing anti-VM and anti-antivirus techniques and targeting security software such as 360Safe, Kingsoft and Huorong. Seqrite’s analysis also links the operation’s backend to SonderCloud Limited, a Hong Kong hosting provider associated with cybercrime operations.