Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
Active malware campaign uses spoofed vendor download pages to distribute malicious installers targeting Chinese-speaking users and China-based operations of multinational organizations The campaign, attributed to Chinese threat cluster Silver Fox (Yinhu), deploys malware that disables Windows Update services, weakens Microsoft Defender through exclusions, and establishes C2 communication on non-standard ports Two distinct delivery vectors were observed: wrapper installers and Windows Installer s
Analysis
TL;DR
- Active malware campaign uses spoofed vendor download pages to distribute malicious installers targeting Chinese-speaking users and China-based operations of multinational organizations
- The campaign, attributed to Chinese threat cluster Silver Fox (Yinhu), deploys malware that disables Windows Update services, weakens Microsoft Defender through exclusions, and establishes C2 communication on non-standard ports
- Two distinct delivery vectors were observed: wrapper installers and Windows Installer service (msiexec.exe) exploitation, both using randomized executable names to evade detection
- The malware creates SYSTEM-level scheduled tasks, deletes volume shadow copies, modifies DACLs to prevent removal, and uses ValleyRAT/Gh0st RAT capabilities for keystroke logging, clipboard capture, and remote access
- This represents an evolution in Silver Fox's TTPs, combining social engineering via high-fidelity website clones with sophisticated defensive evasion techniques
Why It Matters
This campaign demonstrates the growing sophistication of Chinese threat actors in combining social engineering with advanced defensive evasion, making detection increasingly difficult for security teams. The targeting of legitimate software download ecosystems through spoofed vendor pages highlights a persistent and effective attack vector that organizations must address through user awareness and technical controls.
Technical Details
- Infrastructure: Malicious websites hosted on .com.cn and .hl.cn domains impersonating legitimate vendors (Microsoft Edge, Baidu, Kaspersky, Razer, SteelSeries, etc.), with payloads served from gehie246[.]com using server-side generated archives with changing hashes
- Execution chain: ZIP archive containing wrapper installer (randomized names like "a_instapp83353001.exe") or msiexec.exe-based delivery, both launching first-stage payloads that establish persistence through scheduled tasks
- Defensive evasion: SYSTEM-level scheduled task configures Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, modifies DACLs using icacls to prevent directory removal, and disables Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc) while renaming DLLs and clearing SoftwareDistribution cache
- C2 communication: Application-layer protocols on non-standard ports (5090, 7031, 7088-7090, 8050, 28290, 28300) using domains iualef[.]net and oijfwe[.]net
- Malware capabilities: ValleyRAT/Gh0st RAT features include system information collection, screenshots, log wiping, C2 updates, modular DLL/shellcode downloads, keystroke and clipboard capture, and anti-analysis window scanning
Industry Insight
- Security teams should implement application whitelisting and monitor for suspicious scheduled task creation, particularly those running as SYSTEM with PowerShell or icacls arguments, as these are strong indicators of this campaign's persistence mechanisms
- Organizations should enforce strict download policies requiring verification of software sources through official vendor channels, and implement network segmentation to limit C2 communication on non-standard ports
- The convergence of Silver Fox and GoldenEyeDog/CuboidalCanine using ValleyRAT suggests shared tooling ecosystems among Chinese threat groups, indicating potential for coordinated TTP evolution and the need for threat intelligence sharing across sectors
Disclaimer: The above content is generated by AI and is for reference only.