Fake Software Installers Weaken Windows Security
A China-linked cyberattack campaign spreads through fake software download sites.
1Campaign Target and Method
Microsoft identified a China-based cyberattack group, Silver Fox (Yinhu), distributing malicious installers via fake software download sites. These sites mimic popular software download pages, primarily targeting multinational companies operating in China and Chinese-speaking users. Once executed, the malicious installers establish persistence, disable security measures, and communicate with attacker-controlled infrastructure.
2Affected Sectors and Geographies
The attack campaign impacted organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Microsoft assessed with moderate confidence that the campaign is linked to the Chinese threat group Silver Fox, known for distributing malware like Gh0st RAT and ValleyRAT through spoofed vendor download pages.
3Technical Details of the Attack
The malicious installers are distributed from websites hosted on .com.cn and .hl.cn infrastructure. These sites are high-fidelity clones of legitimate vendor pages, prompting users to download ZIP archives. The downloaded archive retains the same filename, but its hash changes with each download, indicating server-side dynamic payload generation for each request.
4Disabling Security Measures
The malware stops and disables Windows Update services, renames update DLLs, and deletes the SoftwareDistribution cache. It also configures Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, and prevents standard users from removing payload directories. These steps increase system vulnerabilities and facilitate long-term attacker access.
5Command and Control Infrastructure
The malware establishes command-and-control (C2) communication over non-standard ports like 5090, 7031, 7032, 7088-7090, 8050, 28290, and 28300 using application-layer protocols. Two C2 domains linked to this campaign are 'iualef[.]net' and 'oijfwe[.]net.' Microsoft Defender initiated automated containment procedures to limit the attack's impact.
6ValleyRAT and DLL Sideloading
Kaspersky uncovered a malicious installer distributing a modified version of QN Wallpaper, a Chinese desktop wallpaper management tool, to initiate a DLL sideloading chain delivering ValleyRAT. While the original QN Wallpaper is adware, attackers repurposed it to execute malicious code under the guise of a signed process, complicating detection.
7ValleyRAT Capabilities
ValleyRAT is a sophisticated malware with extensive capabilities, including system information collection, computer reboot/shutdown, screenshot capture, log wiping, C2 address updates, additional DLL/shellcode module downloads, and keylogger log transmission with clipboard data. Attackers are motivated by cyber espionage and financial gain, targeting organizations across multiple countries.
8Industry Developments
An Expel report linked ValleyRAT usage to CuboidalCanine, a GoldenEyeDog subgroup targeting the gambling industry by abusing code-signing certificates to bypass security controls. Chinese authorities took action in 2026 against cybercrime cases distributing a new Silver Fox trojan variant, as reported by China Daily.
Original article: The Hacker News — Sahte Yazılım Yükleyicileri Windows Güvenliğini Zayıflatıyor