Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

This threat involves a malware campaign distributing malicious installers via fraudulent software-download websites that impersonate trusted vendors. The campaign primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The malicious installers deploy malware capable of establishing persistence, disabling Windows Update services, configuring Microsoft Defender exclusions to evade detection, deleting volume shadow copies to hinder recovery, and establishing command-and-control communications for remote access. Microsoft attributes this activity with moderate confidence to the Chinese threat cluster Silver Fox, known for using spoofed vendor download pages to distribute remote access trojans such as Gh0st RAT. The campaign uses high-fidelity clones of legitimate vendor websites hosted on Chinese domains and delivers server-side generated payloads through ZIP archives.

The malware disables Windows Update, preventing the system from receiving security patches, and configures Microsoft Defender exclusions, weakening endpoint protection. It deletes volume shadow copies, which impedes recovery from ransomware or other destructive attacks. The malware establishes persistence and command-and-control channels, enabling remote attackers to maintain access and control over compromised systems. This can lead to data theft, espionage, or further malicious activities within targeted organizations.

No official patch or fix is available as this is a malware campaign rather than a software vulnerability. Mitigation focuses on user awareness to avoid downloading software from untrusted or spoofed websites, verifying software sources, and employing endpoint detection and response solutions capable of detecting and blocking such malicious installers. Organizations should monitor for indicators of compromise such as the listed malicious domains and implement network controls to block access to these domains. Regular backups and offline storage of critical data can mitigate the impact of volume shadow copy deletion.