Your Chinese Subsidiary Downloaded the Right Software From the Wrong Site

Microsoft Defender Experts has documented an active campaign running high-fidelity clones of vendor download pages on .com.cn and .hl.cn domains, funnelling victims to a small set of shared delivery hosts. Microsoft assesses with moderate confidence that the activity is consistent with the publicly reported Silver Fox (Yinhu, 银狐) fake-software campaign, and explicitly has not attributed it to a nation-state actor.

The targeting is the part European and American security teams keep misreading. Microsoft observed victims predominantly among China-based operations of multinational organisations and Chinese-speaking users, across healthcare and medical devices, manufacturing, gaming, technology, logistics, government and higher education. If your organisation has a Chinese entity, a Chinese-speaking workforce or a supplier whose staff download tools from Chinese-language pages, this is inside your estate, not adjacent to it.

The wrapper rotates, the payload does not

In one case, telemetry captured a device visiting a counterfeit Razer page and pulling an archive from a delivery host, with two content-distinct copies of the same-named file written about 69 seconds apart. The archive is generated server-side, per request, so its hash is worthless as an indicator.

The inner payload is a different matter. Microsoft observed the same stage-one SHA-256 across many randomised names and directories. That inverts the usual instinct. Blocking the download by hash fails; hunting the staged executable by hash works. So does the drop pattern itself: a randomised executable in a randomised folder under C:\Users\Public, C:\ProgramData or Program Files (x86), spawned by a browser, an archiver, explorer.exe, svchost.exe or msiexec.

That last parent matters. Alongside the wrapped-installer chain, Microsoft observed msiexec.exe invoked in embedded mode to write and launch the same randomised payload, giving the attacker execution under a signed Windows component.

Fabricated provenance

One later-stage payload declares itself a Philips speech driver, complete with company name, file description and version. The version resource also still contains an unfilled build-template placeholder in the product name field. The metadata was manufactured for the payload rather than inherited from real vendor software, and the leftover placeholder is the proof. Another payload borrows the runtime of a commercial software updater and uses it to retrieve further payloads from an attacker-controlled cloud storage bucket over TLS, which is why the network side looks unremarkable.

Dismantling the host, not just evading it

The follow-on activity is more aggressive than typical commodity malware. A short-lived scheduled task runs as SYSTEM solely to write Defender path exclusions, then deletes itself. PowerShell adds sweeping exclusions covering entire drives. Shadow copies are deleted. Payload directories are hardened with icacls so a standard user cannot remove them. Windows Update is stopped, disabled, its DLLs renamed and its cache erased.

That last step is the one to sit with. This is not evasion, it is denial of remediation. A host in this state will not receive patches, and the operator has taken hands-on-keyboard control in a subset of environments, so the sequence is not a fixed script you can pattern-match end to end.

Group by ASN, not by geography

Microsoft’s infrastructure analysis is the most reusable part of the report. The look-alike domains sit across unrelated netblocks and multiple registered country codes, which defeats grouping by address space or geography. At autonomous system level, with nameserver pairs as a secondary signal, they collapse into a small number of procurement channels. Microsoft is careful to add that these are shared commercial providers with substantial legitimate tenancy, so the ASN is a hunting pivot, not a blocklist entry. Treat it as a way to find the next look-alike domain before it is used, not as something to drop into a deny rule.

What to do

• Enforce Tamper Protection. It blocks the exclusion write even when the payload holds SYSTEM, which is the specific technique this campaign depends on.
• Alert on the tamper sequence rather than its components: a SYSTEM scheduled task writing Defender exclusion paths and then self-deleting, shadow copy deletion, and Windows Update services being stopped and disabled.
• Hunt the drop pattern and the stable payload hashes. Ignore the archive hashes.
• Correlate download referrer to delivery host, so the pairing survives individual domain rotation.
• Reduce the number of employees who need to fetch installers from the public web at all. A managed catalogue or internal package repository turns this from a judgement call at the endpoint into a controlled process.

The pattern behind three stories in one week

Attackers subverted a signed Faronics installer by owning the management console. A BGP hijack turned a legitimate Virtualizor update channel into a malware delivery route. Now counterfeit vendor pages regenerate their payload per request. Three different mechanisms, one target: the trust an organisation places in how software arrives. In each case the endpoint control that would have helped was not better malware detection. It was knowing which software is allowed to arrive, and from where.