Full Report
An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft
Analysis Summary
# Morning News Roll-up September 02, 2026
## Overview
An active malware campaign attributed to the "Silver Fox" threat cluster is targeting multinational organizations, specifically their China-based operations. The attackers utilize high-fidelity spoofed software websites to distribute malicious installers that disable system updates and weaken Microsoft Defender to establish long-term persistence.
## Top Stories
### Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
- Summary: A sophisticated social engineering campaign is using counterfeit download pages for popular software (such as Microsoft Edge, Baidu, and Kaspersky) to deliver malware. The payloads are designed to bypass security by modifying Discretionary Access Control Lists (DACLs), disabling Windows Update services, and configuring Microsoft Defender exclusions via PowerShell.
- Source: hxxps://thehackernews[.]com/2026/09/fake-software-installers-disable[.]html
# Main Topic
Active distribution of malicious installers through spoofed vendor websites to compromise multinational organizations and Chinese-speaking users.
## Key Points
- **High-Fidelity Impersonation:** Attackers use clones of legitimate vendor websites (Edge, Razer, Sogou, etc.) to trick users into downloading ZIP archives.
- **Dynamic Payloads:** The archive maintains the same filename, but the file hash changes on every download, suggesting server-side generation to evade static signature detection.
- **Security Neutralization:** The malware aggressively disables Windows security features, including stopping services like `wuauserv` and `WaaSMedicSvc`, and deleting volume shadow copies.
- **DACL Modification:** The malware uses `icacls` to modify folder permissions, preventing standard users from deleting the malicious payload directories.
## Threat Actors
- **Silver Fox (aka Yinhu):** A Chinese threat cluster assessed with moderate confidence to be behind the campaign.
- **Motivations:** Likely espionage or financial gain, given the deployment of Gh0st RAT and ValleyRAT (WinOS 4.0).
## TTPs
- **Social Engineering:** Use of deceptive SEO or advertisements to drive traffic to counterfeit `.com.cn` and `.hl.cn` domains.
- **Persistence:** Created through scheduled tasks masquerading as routine IT productivity jobs.
- **Defense Evasion:**
- Execution via `msiexec.exe` to launch randomized executables.
- PowerShell scripts to set Microsoft Defender exclusions.
- Renaming system DLLs to break the Windows Update mechanism.
- **C2 Communication:** Use of non-standard ports (e.g., 5090, 7031, 28300) for application-layer protocol communication.
## Affected Systems
- **Operating Systems:** Microsoft Windows (various versions).
- **Targeted Sectors:** Healthcare, manufacturing, gaming, technology, logistics, government, and education.
- **Geographic Focus:** China-based operations of multinational organizations and Chinese-speaking users.
## Mitigations
- **Network Filtering:** Block known malicious domains and non-standard ports associated with this campaign.
- **Endpoint Protection:** Ensure "Attack Disruption" features in XDR platforms are active to automatically contain compromised accounts/devices.
- **Policy Enforcement:** Restrict the ability of standard users to execute `msiexec.exe` from untrusted directories and monitor for unauthorized `icacls` or PowerShell `Add-MpPreference` commands.
- **User Training:** Educate employees to download software only from official, verified global domains rather than localized third-party mirrors.
## IoCs
- **Malicious Domains:**
- gehie246[.]com
- app-microsoft-edge[.]com[.]cn
- baidu-pan[.]com[.]cn
- calibre-ebook[.]com[.]cn
- cn-drawio[.]com[.]cn
- kaspersky-lab[.]hl[.]cn
- zh-diskgenius[.]com[.]cn
- iualef[.]net (C2)
- oijfwe[.]net (C2)
- **Processes/Tools:**
- a_instapp83353001.exe
- ainst8663586104.exe
## Conclusion
This campaign demonstrates a high level of operational maturity by Silver Fox, moving beyond simple malware delivery to active system neutralization. Organizations with operations in China should immediately audit their systems for the mentioned IoCs and monitor for unauthorized changes to Windows Update services and Defender exclusions. High-fidelity website cloning remains a potent vector; thus, endpoint monitoring of installation events is critical.