Invoice Phish Leads to Resilient ValleyRAT

How the Attack Unfolded

The campaign targeting a Japanese industrial manufacturer began with a simple, familiar lure: an invoice-themed phishing email. Once opened, the attack chain used attacker-controlled content hosted on legitimate QQ and Tencent Cloud services, giving the malicious payload a layer of trust that standard email filtering may not catch. From there, attackers abused legitimate executables, ConvertToPDF.exe and PDFDirect.exe, to sideload a malicious DLL named PDFCORE8.dll. This technique lets malware piggyback on trusted, signed software rather than relying on an obviously suspicious file.

Why the Campaign Succeeded

Several factors made this attack effective. First, the invoice pretext is a routine part of business communication for finance and procurement staff, making it easy to overlook as a threat. Second, hosting malicious content on well-known consumer and cloud platforms like QQ and Tencent Cloud reduces suspicion, since employees may assume traffic to recognizable domains is safe. Third, the malware employed a modular Bring Your Own Vulnerable Driver (BYOVD) approach with multiple kernel drivers to terminate endpoint security tools, undermining defenses that organizations typically rely on to catch this kind of intrusion.

Persistence and Resilience

What sets this campaign apart is its recovery design. The malware used a dual-layer watchdog architecture, with an external watchdog checking every 30 seconds whether the loader is still running and relaunching it if not. A scheduled task also ensured the malware would relaunch on user logon. Command-and-control communication followed, along with shellcode download and injection into a suspended svchost.exe process. This combination of persistence and self-repair makes the malware, ValleyRAT, considerably harder to remove than a typical infection, since simply killing a process or deleting a file is unlikely to fully stop it.

What Defenders and Employees Should Watch For

• Treat unexpected invoice emails as high-risk, and verify the sender through a known, trusted contact method before opening any attachment.
• Be cautious when an invoice workflow asks you to run software, such as an installer or converter, instead of simply viewing a standard PDF.
• Remember that a link or download coming from a well-known cloud or consumer platform is not automatically safe; attackers can and do host malicious content there.
• Report any software that appears to restart itself after being closed, since this can indicate a persistence mechanism like the watchdog design seen in this campaign.

Building Organizational Resistance

Because this attack chain relies on human decisions early on, such as opening an invoice attachment, the strongest defense is a combination of employee awareness and technical controls. Finance, Accounts Payable, Procurement, and IT Helpdesk staff are natural targets for invoice-themed lures and should be trained to recognize red flags: unsolicited invoices, content hosted outside a vendor's normal domain, and file packages that include executables rather than standard documents. Pairing this awareness with monitoring for DLL sideloading, driver abuse, and unusual scheduled tasks helps close the gap between initial phishing contact and full system compromise.

How did the ValleyRAT attack start?

The intrusion began with an invoice-themed phishing email that used attacker-controlled content hosted on legitimate QQ and Tencent Cloud services.

What made this malware hard to remove?

The malware used a dual-layer watchdog design and a scheduled task to relaunch itself on logon, making it notably harder to disrupt than typical malware deployments.

What legitimate software did attackers abuse?

Attackers abused legitimate executables ConvertToPDF.exe and PDFDirect.exe to sideload a malicious DLL called PDFCORE8.dll.

Who is most at risk from this type of attack?

Finance, Accounts Payable, Procurement, Executive Assistants, IT Helpdesk, and Security Operations teams are the primary targets since the lure is invoice-themed.