An active malware campaign is distributing malicious software installers through bogus download websites that impersonate trusted software vendors. The campaign primarily targets Chinese-speaking users and China-based operations of multinational organizations. Victims are lured into downloading fake versions of popular software, which then disable Windows Update and weaken Microsoft Defender protections. The attack has resulted in compromises across multiple organizations and industries. By disabling security mechanisms, the malware leaves systems vulnerable to further exploitation and persistence. Microsoft has identified and reported on this campaign, highlighting its broad impact on enterprise environments.
An active malware campaign attributed with moderate confidence to the Chinese threat cluster Silver Fox (aka Yinhu) uses bogus software-download websites hosted on .com.cn and .hl.cn infrastructure to impersonate legitimate vendors. Users are lured into downloading a ZIP archive from 'gehie246[.]com'. The archive contains a wrapper installer (e.g., 'a_instapp83353001.exe' or 'ainst8663586104.exe') that launches a first-stage payload. A second execution vector abuses the legitimate Windows Installer service (msiexec.exe) to launch a randomized executable. The archive hash changes on every download, indicating server-side payload generation per request. Upon execution, the malware: (1) establishes persistence via scheduled tasks mimicking routine IT/productivity jobs; (2) creates a short-lived SYSTEM-level scheduled task to add Microsoft Defender exclusions via PowerShell; (3) deletes volume shadow copies; (4) modifies DACLs using icacls to prevent payload directory removal by standard users; (5) tampers with Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update DLLs, and deleting the SoftwareDistribution cache; (6) establishes C2 communication over application-layer protocols on non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300). The campaign also leverages DLL sideloading via a modified version of the Chinese desktop wallpaper tool QN Wallpaper to deliver ValleyRAT (aka WinOS 4.0). ValleyRAT is a sophisticated RAT capable of collecting system info, rebooting/shutting down the system, taking screenshots, wiping logs, updating C2 addresses, downloading additional DLL/shellcode modules, capturing keystrokes and clipboard data, and scanning for analysis tools. Gh0st RAT is also associated with this threat cluster. The sub-group CuboidalCanine within GoldenEyeDog also uses ValleyRAT, targeting the gambling industry via watering holes and abusing code-signing certificates.
1. Block and blacklist all identified malicious domains (gehie246[.]com, iualef[.]net, oijfwe[.]net) and the listed counterfeit software download sites at the network perimeter. 2. Monitor and alert on outbound connections to non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300). 3. Ensure Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc) are running and alert on attempts to stop or disable them. 4. Monitor for unauthorized modifications to Microsoft Defender exclusions, especially those set via PowerShell from scheduled tasks running as SYSTEM. 5. Alert on deletion of volume shadow copies and suspicious use of icacls to modify DACLs on program directories. 6. Monitor for suspicious scheduled tasks mimicking IT or productivity job names. 7. Monitor for abuse of msiexec.exe launching randomized or unknown executables. 8. Enable and review Microsoft Defender's automatic attack disruption capabilities. 9. Educate users to only download software from official vendor websites and verify domain authenticity before downloading. 10. Deploy network-level controls to block downloads from .com.cn and .hl.cn domains not explicitly whitelisted for business use. 11. Hunt for ValleyRAT and Gh0st RAT indicators across endpoints using available threat intelligence. 12. Monitor for DLL sideloading patterns, especially involving signed processes loading unexpected DLLs.
gehie246[.]com, iualef[.]net, oijfwe[.]net, app-microsoft-edge[.]com[.]cn, baidu-pan[.]com[.]cn, calibre-ebook[.]com[.]cn, cn-drawio[.]com[.]cn, gw-sogou[.]com[.]cn, kaspersky-lab[.]hl[.]cn, mindmoster[.]com[.]cn, ocam-pc[.]com[.]cn, pc-razerzone[.]com[.]cn, sejda[.]hl[.]cn, steelseries-cn[.]com[.]cn, translate-youdao[.]hl[.]cn, zh-diskgenius[.]com[.]cn, a_instapp83353001.exe, ainst8663586104.exe, TCP port 5090, TCP port 7031, TCP port 7032, TCP ports 7088-7090, TCP port 8050, TCP port 28290, TCP port 28300
