Silver Fox Campaign Distributes Malware via Spoofed Software Websites

The threat cluster identified as Silver Fox (also known as Yinhu) is conducting an active, multi-industry malware campaign targeting organizations primarily in China, including logistics, manufacturing, government, and healthcare sectors. The campaign leverages sophisticated, high-fidelity clones of legitimate vendor software download pages hosted on .com.cn and .hl.cn infrastructure. Users are tricked into downloading ZIP archives from external infrastructure, which contain wrapper installers. Upon execution, the malware performs aggressive defense evasion, including disabling Windows Update services (wuauserv, UsoSvc, uhssvc, WaaSMedicSvc), clearing the SoftwareDistribution cache, and modifying Microsoft Defender exclusions via PowerShell. The campaign has been observed deploying established backdoors such as ValleyRAT (WinOS 4.0) and Gh0st RAT, often utilizing DLL sideloading techniques through legitimate signed applications to maintain persistent, stealthy access.

Attack Chain

1. User navigates to a spoofed vendor download site hosted on attacker-controlled domains (e.g., app-microsoft-edge.com.cn).
2. Victim downloads a ZIP archive containing a wrapper executable (e.g., a_instapp83353001.exe) or triggers an MSI-based installer chain.
3. The installer executes, launching a primary payload that establishes persistence through system-level scheduled tasks.
4. The malware runs as SYSTEM, modifying folder DACLs using icacls to prevent unauthorized deletion by users.
5. The malware disables critical Windows Update services and deletes the SoftwareDistribution cache to prevent security patching.
6. The process modifies Microsoft Defender exclusions via PowerShell to whitelist its own directory.
7. The malware executes secondary payloads or sideloads malicious DLLs through legitimate software (e.g., QN Wallpaper) to bypass security controls.
8. Backdoors (ValleyRAT/Gh0st RAT) establish command-and-control communication over non-standard ports to domains like iualef.net and oijfwe.net.

Impact

The campaign has resulted in confirmed compromises across multiple sectors, including healthcare, government, and manufacturing. If successful, the attack grants the actor full remote control, including the ability to perform keylogging, clipboard exfiltration, screenshot capture, and arbitrary command execution. The systematic weakening of OS-level security protections creates a persistent, long-term foothold within compromised enterprise environments.

Recommendation

1. Deploy Sigma rules to detect the modification of Windows Update services and Microsoft Defender exclusions.
2. Block the documented C2 domains (iualef.net, oijfwe.net) at the network edge and monitor for outbound traffic on non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300).
3. Implement endpoint policy to restrict the execution of unsigned executables from non-standard temporary directories.
4. Hunt for scheduled tasks created as SYSTEM that interact with icacls or PowerShell scripts modifying Defender exclusions.