An active malware campaign exploits lookalike download sites for well-known brands to persuade users to download an installer that appears legitimate, before beginning a multi-stage infection chain involving the creation of persistence mechanisms, weakening Microsoft Defender, disabling Windows Update components, and attempting to connect to attacker-controlled infrastructure. Microsoft Defender Experts said the activity affected multiple organizations and sectors, with the greatest impact on China-linked operations and Chinese-speaking users.
The affected sectors, according to monitoring published in the Microsoft Security Blog, included medical devices, healthcare, manufacturing, gaming, technology, logistics, government, and higher education. Microsoft assesses with medium confidence that the campaign is consistent with Silver Fox activity, also known as Yinhu or 银狐, but has not attributed it to a state-linked actor.
From a Lookalike Download Page to a Persistent Payload
The infection begins with a page impersonating a trusted vendor’s website and displaying a prominent download button. In one case, Microsoft documented a device being redirected to the lookalike site pc-razerzone[.]com[.]cn and downloading an archive named app_setup.6653004.zip from another delivery host. It also linked the archives’ FileOriginReferrerUrl data to the impersonation pages and rotating delivery hosts, as well as to a container suspected of being hosted on Alibaba Cloud Object Storage Service.
The most notable characteristic is that the archive name may remain unchanged while the SHA-256 hash changes with every download, indicating that the payload is generated on the server for each request. Microsoft observed families of archives named app_setup.* , zinst.* , zintall.* , intsoft.* , and innstll.* , with different contents despite the delivery URL remaining the same. The campaign also used domains that imitated brand names on extensions such as .com.cn, .hl.cn, and .cn.
After the archive is opened, the user runs a wrapped installer that creates an executable file at a random path and with a random name, often under C:\Users\Public, C:\Program Files (x86), or C:\ProgramData. Although the names and paths changed, Microsoft observed consistent content in some stages, including a payload with a SHA-256 hash beginning with 676a2a7b94ca, making behavior and static fingerprints more useful than relying on file names.
The campaign also used a parallel path through Windows Installer, in which the archive invokes msiexec.exe in embedded mode to write and execute a random file from a globally writable folder. Microsoft observed more than 20 different payload names delivered this way, with msedge.exe, explorer.exe, and svchost.exe appearing as parent processes in the execution chains.
Impersonating Trusted Files and Abusing System Tools
One later-stage payload attempted to appear as Philips Speech Driver Client Configuration, using metadata attributing the file to Speech Processing Solutions GmbH, while the ProductName value contained the incomplete element TODO: <Product name>. Microsoft also observed svchost.exe running from a non-system path instead of C:\Windows\System32, a behavioral sign that goes beyond the ability of file names alone to reveal tampering.
TrueUpdate Client, associated with Indigo Rose, was used to repurpose the behavior of a legitimate update mechanism to download an additional payload from an Alibaba Cloud OSS container over TLS. Some payloads were repeatedly relaunched through scheduled tasks with names that appeared to represent ordinary technical or productivity functions, with a pattern of re-execution approximately every 60 seconds on infected devices.
How Does the Campaign Try to Prolong Its Persistence?
To obtain higher privileges, the malware created short-lived tasks running with SYSTEM privileges, then used them to write exclusions in Microsoft Defender before running and deleting the task. Code injection into a legitimate application process using CreateRemoteThread was also observed, along with attempts to disable protection through PowerShell, delete shadow copies using vssadmin, tighten permissions on payload folders, and disable Windows Update services such as wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc.
Subsequent communications involved six-character .net domains and IP addresses with nonstandard ports, including 5090, 7031, 7032, 7088 through 7090, 8050, 28290, and 28300. Some command-and-control endpoints were intermittently unavailable, while communications with cloud object stores remained ongoing, reflecting a separation between the communication layer and the payload-hosting layer.
What Changes in Practice for Defense Teams?
The campaign showed that blocking a file name or a single hash will not be sufficient; the archives regenerate themselves, executable file names are random, and the infrastructure relies on rotating domains and hosts. Microsoft therefore recommends monitoring for the creation of random executables inside C:\Users\Public, C:\Program Files (x86), and C:\ProgramData; correlating the referrer page address with the delivery address; and investigating short-lived SYSTEM tasks that modify Defender exclusions and then delete themselves.
Microsoft recommends enabling Tamper Protection and attack surface reduction rules that prevent the execution of untrusted files or obfuscated scripts, as well as copied or impersonated system tools, in addition to advanced ransomware protection. ZIP archives arriving from similar impersonation domains should also be handled cautiously, and connection indicators associated with the campaign should be monitored or blocked after validation.
Microsoft Defender uncovered multiple stages of the activity and activated Attack Disruption in cases that met its criteria, resulting in the containment of devices, accounts, and attempted lateral movement over SMB. However, the company explained that containment does not mean that every persistence mechanism has been removed; responder intervention remained necessary to eradicate the remaining tasks, files, and traces. This is an important practical point: even when automated detection succeeds, response teams should follow it with a full review of persistence and changes made to protection, updating, and recovery mechanisms.