Preft, also known as Dtrack or Valefor, is a multi-stage backdoor associated in the reporting with Silent Chollima. It can upload and download files, execute operator commands, and retrieve additional plugins, providing flexible post-compromise access. The tool appeared in attacks against private U.S. companies that had no obvious intelligence value, activity assessed as potentially extortion-driven rather than traditional espionage. Campaign samples used a fake Tableau certificate and other certificates described as unique to the operation.