Counterfeit installers to system compromise: Tracking a deceptive software download campaign

The threat is a malware campaign distributing counterfeit installers via fake software download sites impersonating trusted vendors, primarily targeting Chinese-speaking users and China-based operations in diverse sectors. The campaign employs dynamically generated installers with rotating hashes and randomized payload staging paths hosted on spoofed vendor pages under .com.cn and .hl.cn domains. Malicious payloads establish persistence through scheduled tasks, disable Windows Defender and Windows Update, delete shadow copies, and communicate with command-and-control servers over non-standard ports. The activity aligns with publicly reported Silver Fox operations but lacks confirmed nation-state attribution.

Successful infection results in system compromise with persistence mechanisms, disabling of key security features (Windows Defender, Windows Update), deletion of shadow copies hindering recovery, and establishment of command-and-control communication channels. This enables attackers to maintain long-term access and control over affected systems, potentially leading to data theft, espionage, or further malicious activity.

No official patch or fix is applicable as this is a malware campaign leveraging social engineering and counterfeit websites. Mitigation focuses on user awareness to avoid downloading software from untrusted sources, verifying vendor websites carefully, and maintaining updated endpoint protection solutions. Organizations should monitor for signs of persistence mechanisms such as suspicious scheduled tasks and disablement of security features. Incident response should include restoring shadow copies and re-enabling security protections if compromised.