WORLD WATCH · October 28, 2026 · NEWS
ValleyRAT uses fake Korean company sites
Attackers used fake websites to support ValleyRAT infrastructure.
- Reported by
- Malware News
- Outlets reporting
- 1
- Category
- NEWS
- Newest report
- October 28, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- ValleyRAT infrastructure used fake Korean sites.
- Sites impersonated Doosan Robotics and Cheonjeong.
- Attackers requested payments in cryptocurrency.
What happened
The report comes from Malware News. Attackers built websites to impersonate Doosan Robotics. Attackers built websites to impersonate Cheonjeong. The fake sites used logos from those companies. The fake sites used promotional videos from those companies. The fake sites used descriptions from those companies. The sites requested payments in cryptocurrency.
Why it matters
The impersonation extended to known Korean companies. The use of company assets increased site legitimacy for targeted users. The payment request in cryptocurrency limits traceability for affected targets.
What to do
- Verify site domains before payment to a supplier.
- Check payment requests against an official supplier channel.
- Report suspected impersonation sites to a known security contact.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 28, 2026). This brief summarizes reporting by Malware News. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.