Fast Facts
- Malicious actors impersonate trusted software vendors via counterfeit Chinese-language websites, distributing dynamic malware payloads through malicious installers and Windows Installer abuse.
- The malware achieves persistence by modifying system configurations, disabling Windows updates, and creating scheduled tasks to evade detection and maintain control over compromised systems.
- The campaign targets diverse sectors including healthcare, government, and tech, primarily focusing on Chinese-speaking users and organizations in China, with command-and-control channels on non-standard ports.
Threat Overview, Attack Techniques, and Targets
This malware campaign involves fake software download websites. These sites impersonate trusted vendors and are hosted on Chinese infrastructure. The sites use Chinese-language content and feature high-quality replica web pages. When users click download buttons, they receive ZIP archives with malicious installers. The payloads are generated dynamically, which makes each download unique. Opening these archives launches a wrapper installer, which then executes the first-stage malicious payload. The malware can also use Windows Installer service to run a random executable, masquerading as legitimate software.
Once installed, the malware establishes persistence by creating scheduled tasks. These tasks imitate regular IT activities. The malware also modifies Windows Defender and Windows Update to weaken the device’s security. It stops various update and security services, renames DLL files, and clears update caches. It communicates with attacker-controlled servers over uncommon network ports like 5090, 7031, 7090, and others. The campaign mainly targets China-based operations of multinational companies and Chinese-speaking users. Victims span industries such as healthcare, manufacturing, gaming, technology, logistics, government, and education.
Microsoft assesses this activity as connected with a Chinese group called Silver Fox or Yinhu. This group has a history of using fake vendor websites and distributing malware like Gh0st RAT and ValleyRAT.
Impact, Security Implications, and Remediation Guidance
The malware can disable Windows security features and weaken system protections. It stops Windows Update services and modifies DLL files, making system updates difficult. It deletes shadow copies and changes permissions to prevent removal. The malware establishes command-and-control links on non-standard ports, which can be used for further malicious actions.
Microsoft believes the attack’s goal is to compromise systems, though the exact purpose remains unclear. Because of these activities, devices become more vulnerable. The malware’s ability to disable security tools makes detection and removal more challenging.
For remediation, organizations should consult the relevant vendor or authority. Specific guidance on removing this malware and restoring security should be obtained from Microsoft or other trusted cybersecurity sources.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
