CleverSoar and Winos4.0 Campaigns Target Chinese and Vietnamese Windows Users

Rapid7 disclosed a targeted malware campaign using a new installer dubbed CleverSoar to infect Chinese- and Vietnamese-speaking Windows users with the Winos4.0 framework, the Nidhogg rootkit, and a custom backdoor. The installer performs extensive anti-analysis and targeting checks before execution, including VM and debugger detection, sandbox-user validation, and system language discovery consistent with MITRE ATT&CK T1614.001, then escalates privileges, disables security tools, turns off the Windows firewall, installs persistence, and hides artifacts. Rapid7 said the activity appears aligned with a long-running espionage effort focused on surveillance, keystroke logging, data theft, and covert remote control.

The findings overlap with Fortinet reporting on malware operations aimed at Chinese-speaking users, including a Winos4.0 campaign spread through trojanized gaming utilities and a separate ValleyRAT intrusion set attributed to the suspected Silver Fox group. Fortinet said Winos4.0 is a modular framework rebuilt from Gh0st RAT that uses staged loaders, shellcode injection, registry-stored modules, and persistence via Run keys or scheduled tasks, while plugins enabled screenshot capture, document theft, clipboard monitoring, and searches for crypto-wallet browser extensions. Rapid7 assessed with medium confidence that CleverSoar may be linked to the same actor behind Fortinet's ValleyRAT-related activity, citing shared tradecraft such as in-memory execution, anti-VM checks, privilege escalation, and evasion tailored to regional security products.