Full Report
Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver FDMTP, a
Analysis Summary
# Incident Report: QuickFox Supply Chain Attack (FDMTP Backdoor)
## Executive Summary
A long-standing supply chain attack targeted QuickFox, a VPN and network acceleration tool, to distribute the FDMTP backdoor. Attributed to the Chinese state-sponsored threat actor Mustang Panda, the campaign involved trojanizing Windows installers to deliver multi-stage JavaScript and DLL-based malware. The attack focused on fingerprinting specific high-value users while evading detection through masqueraded domains and process checks.
## Incident Details
- **Discovery Date:** August 2025 (Initial reporting by Fortinet)
- **Incident Date:** Ongoing from at least August 2025 to August 2026
- **Affected Organization:** QuickFox (VPN/Network Accelerator)
- **Sector:** Technology / Telecommunications / VPN Services
- **Geography:** Global (Specifically targeting overseas Chinese users)
## Timeline of Events
### Initial Access
- **Date/Time:** July 25 – August 13, 2025 (Introduction of malicious code)
- **Vector:** Supply Chain Compromise
- **Details:** Attackers modified the QuickFox Windows installer (versions starting 3.0.51.0). A modified Electron renderer HTML file was used to execute a JavaScript-based loader.
### Lateral Movement
- **Details:** The report focuses primarily on endpoint compromise; however, the FDMTP backdoor supports plugin loading, which allows attackers to deploy additional tools for internal network movement once a foothold is established.
### Data Exfiltration/Impact
- **Details:** The FDMTP implant gathers sensitive system information, including active window titles, installed antivirus software, .NET versions, and user details. The primary impact is the establishment of a persistent, expandable backdoor on the victim's machine.
### Detection & Response
- **How it was discovered:** Identified by Fortinet FortiGuard Labs and tracked by other firms like Trend Micro and Darktrace.
- **Response actions taken:** QuickFox removed the malicious components in version 3.59.6 following responsible disclosure.
## Attack Methodology
- **Initial Access:** Trojanized software installer (Supply Chain).
- **Persistence:** Implementation of FDMTP as a secondary tool, likely maintained through registry keys or startup folders typical of this malware family.
- **Defense Evasion:**
- Use of masqueraded domain: `cdns3.51quickfox[.]cn`.
- Obfuscated JavaScript mimicking legitimate Firebase SDKs.
- Process checks to avoid execution if "steam.exe" is present (likely to avoid detection by casual users/gamers).
- Use of DLL side-loading (Generation 1 and 2).
- **Discovery:** Fingerprinting the OS, checking for cryptocurrency wallets, developer tools (IntelliJ, VS Code, Git), and enterprise software.
- **Collection:** Gathering active window titles and system metadata.
- **Exfiltration:** Sending system profiles and process lists to the C2 server.
- **Impact:** Unauthorized remote access and potential for further payload delivery.
## Impact Assessment
- **Financial:** Unknown; potential loss for users of compromised cryptocurrency wallets (Exodus, Binance, etc.).
- **Data Breach:** Exposure of system configurations, user activity (window titles), and installed software lists.
- **Operational:** Integrity of the QuickFox software was compromised for approximately one year.
- **Reputational:** High impact to QuickFox’s brand as a "trusted" tool for overseas users.
## Indicators of Compromise
- **Network Indicators:**
- `cdns3.51quickfox[.]cn`
- **File Indicators:**
- `firebase-app-compat.js` (Malicious version)
- `Client.dll` (FDMTP implant)
- `update.bin` (Encrypted Generation 2 payload)
- **Behavioral Indicators:**
- Unexplained `tasklist` executions.
- Outbound connections to non-standard domains from VPN software components.
## Response Actions
- **Containment:** QuickFox patched the installer to remove malicious hooks.
- **Eradication:** Security vendors updated signatures to detect FDMTP and the malicious JS loaders.
- **Recovery:** Users are advised to update to QuickFox version 3.59.6 or higher and scan systems for FDMTP remnants.
## Lessons Learned
- **Software Integrity:** Even "trusted" acceleration tools can be high-value targets for state-sponsored actors.
- **Targeted Selection:** The malware's specific check for developer and enterprise tools suggests the attackers were seeking high-value corporate or technical targets rather than a broad consumer base.
- **Obfuscation Effectiveness:** Mimicking legitimate libraries (Firebase) remains an effective way to hide malicious code within web-integrated desktop apps (Electron).
## Recommendations
- **For Organizations:** Implement Software Bill of Materials (SBOM) and code-signing verification for third-party tools used by employees.
- **For Users:** Always download software from official sources and monitor for unusual behavior in background applications.
- **For Developers:** Ensure CI/CD pipelines are secured to prevent unauthorized code injection into production installers.