Counterfeit installers to system compromise: Tracking a deceptive software download campaign

1. Executive summary

Microsoft reports an active campaign using counterfeit Chinese-language software-download sites to compromise Windows systems, primarily within China-based operations of multinational organisations and among Chinese-speaking users. Successful execution establishes scheduled-task persistence, weakens Microsoft Defender and Windows Update, deletes shadow copies, injects into legitimate processes, communicates with attacker infrastructure and, in observed cases, attempts SMB lateral movement and supports hands-on-keyboard activity. EMEA financial-services firms should prioritise subsidiaries, outsourced operations and users downloading software for China-based environments; infection can materially degrade endpoint protection, recovery and update controls before lateral movement begins. No CVE is implicated, so CVSS severity and CISA KEV status are not applicable; Microsoft’s moderate-confidence association with “Silver Fox”/“Yinhu” is unconfirmed, neither name has a MITRE ATT&CK actor profile in the verified reference data, and the reporting is single-sourced.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

The source does not establish an incident at a client, disruption to a regulated service, reportability threshold, or compromise of an actual ICT supplier. A counterfeit site impersonating a vendor is not evidence that the vendor or its software supply chain was compromised. Clients identifying internal compromise must assess their own operational impact against applicable DORA, NIS2 or UK NIS obligations.

3. Technical analysis & attack chain

The following chain is confirmed through Microsoft endpoint and network telemetry but remains single-sourced; independently verify before enforcement.

1. Initial access through counterfeit download sites. Users reached high-fidelity pages impersonating Razer, Microsoft Edge, Kaspersky, Sejda, DiskGenius, Baidu Netdisk, Calibre and other products. The infrastructure predominantly used .com.cn, .hl.cn and .cn domains and Chinese-language content. This was user-driven execution of a malicious file, not exploitation of a CVE; CVSS and CISA KEV status therefore do not apply.
2. Per-request archive generation. In one directly observed case, pc-razerzone[.]com[.]cn directed the user to www[.]gehie246[.]com/712down, which delivered app_setup.6653004.zip. Two content-distinct archives using that filename were written within approximately 69 seconds. Microsoft observed the same behaviour across app_setup.*, zinst.*, zintall.*, intsoft.* and innstll.*, indicating server-side regeneration intended to defeat filename- and archive-hash-based controls.
3. Wrapper execution and randomised staging. The user opened the archive with 7zFM.exe, 360zip.exe or WinRAR.exe. Generated wrapper names included a_instapp83353001.exe, z_instapp83351010.exe, ainstaller-86533003.exe and ainst8663586104.exe. The wrapper launched a stable stage-one payload from a randomised directory and filename, commonly under:

• C:\Users\Public\<random>\<random>.exe
• C:\ProgramData\<random>\<random>.exe
• C:\Program Files (x86)\<random>\<random>.exe

Examples included C:\Users\Public\yZ6A88\9bEELI.exe, C:\Users\Public\sE94yD\aLcUaw.exe and C:\Users\Public\nvdPX5\2b3L5i.exe.

4. Parallel Windows Installer execution. Microsoft also observed msiexec.exe -Embedding E Global\MSI0000 writing and launching randomised executables beneath C:\Users\Public\. More than 20 payload names were delivered this way, with parent processes including msedge.exe, explorer.exe and svchost.exe. The technique gains execution through a signed Windows component; the installer still performs its intended function.
5. Masquerading and DLL side-loading. A later-stage payload with SHA-256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 declared fabricated Philips-related metadata:

• CompanyName: Speech Processing Solutions GmbH
• FileDescription: Philips Speech Driver Client Configuration
• OriginalFileName: PhilipsSpeechDriverConfiguration.exe
• ProductVersion: 4.7.471.07
• ProductName: TODO: <Product name>

It loaded XPSPLOG.dll from its own directory. The stage-one payload similarly used UxEnhance64.dll. Microsoft also observed svchost.exe executing from the non-system path D:\hellothere\svchost.exe, rather than C:\Windows\System32.

6. Persistence and further payload retrieval. Disguised scheduled tasks repeatedly launched payloads from C:\ProgramData\, typically at an approximately 60-second cadence:

The persistent payload beuv4Mie.exe carried Indigo Rose TrueUpdate Client metadata (OriginalFileName: tu_rt.exe, ProductVersion: 3.8.0.0) and wrote _ir_tu2_temp_* artefacts. It connected over TLS/443 to upitem.oss-cn-hangzhou.aliyuncs[.]com and wrote C:\ProgramData\uwMUCYBN\SaYC4Mga.exe, repurposing a legitimate update runtime for ingress tool transfer.

7. SYSTEM execution and defence impairment. The malware created a short-lived task named Task1 with SCHTASKS /RL HIGHEST /RU "SYSTEM", used it to write Microsoft Defender exclusions, then immediately ran and deleted the task. Other observed actions included:

• Broad Add-MpPreference -ExclusionPath exclusions covering C:\, C:\ProgramData, C:\Users, C:\Program Files (x86) and %LOCALAPPDATA%.
• vssadmin delete shadows /all /quiet.
• icacls changes restricting removal of payload files.
• Stopping and disabling wuauserv, UsoSvc, uhssvc and WaaSMedicSvc.
• Renaming WaaSMedicSvc.dll and wuaueng.dll with _BAK.dll suffixes.
• Setting NoAutoUpdate, deleting the SoftwareDistribution cache and disabling Windows Update scheduled tasks.
• Writing a malicious Windows Defender Application Control policy to the code-integrity store.

8. Injection, C2 and attempted lateral movement. A scheduled payload with SHA-256 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17 used CreateRemoteThread to inject into a legitimate user application milliseconds after it started. C2 used TLS/443 cloud staging and application-layer traffic over ports 5090, 7031, 7032, 7088–7090, 8050, 28290 and 28300. Directly observed attempts included 47.239.232[.]245:8050, 47.243.218[.]255:28300, 103.156.25[.]35:7031 and 103.183.3[.]162:5090. Microsoft also blocked attempted SMB remote-file access to additional hosts and identified hands-on-keyboard activity in a subset of environments.

Microsoft’s infrastructure analysis grouped several lure domains through AS132839 and AS8796, while another used a CDN. These are shared commercial providers with unrelated tenants: treat ASNs, netblocks and nameservers as hunting pivots, not blocklist entries.

No data-access or exfiltration mechanism was documented. No ransomware deployment or extortion activity was reported; shadow-copy deletion is recovery inhibition but does not, by itself, establish ransomware activity.

Microsoft assesses with moderate confidence that the activity is consistent with reporting labelled “Silver Fox” or “Yinhu”. This attribution is unconfirmed: the supplied reference data contains no MITRE ATT&CK profile for either name, Microsoft did not attribute the activity to a nation-state, and no independent source was supplied.

4. Mitigation & containment

P1 — within 24 hours

1. Contain matching systems and accounts. Isolate endpoints matching the hashes, task names, randomised staging patterns, C2 activity or Defender alerts listed below. Contain and reset accounts associated with hands-on-keyboard or SMB lateral-movement alerts.
2. Block campaign infrastructure. Apply alert-and-block controls to the exact lure, delivery and C2 indicators in §5 across DNS, secure web gateway, endpoint network protection and egress firewalls. Do not block entire ASNs, nameservers, Alibaba OSS or geographic ranges.
3. Enable available Microsoft controls. Confirm Microsoft Defender SmartScreen, Network Protection, cloud-delivered antivirus protection, Tamper Protection and Defender XDR Attack Disruption are enabled. Enable the applicable attack-surface-reduction rules referenced by Microsoft where compatible with the environment.
4. Preserve evidence before eradication. Capture Task Scheduler definitions and history, process trees, downloaded ZIP files, payloads, Defender exclusions, service configurations, Windows Update registry policy, code-integrity policies, renamed _BAK.dll files and network telemetry.

P2 — within 72 hours

1. Eradicate persistence. Validate and remove the four named scheduled tasks, Task1 remnants and payloads launched from randomised directories. Do not identify malware solely by its generated filename: use hashes, process ancestry, task relationships and metadata.
2. Restore security controls. Remove unauthorised Defender exclusions; verify Tamper Protection and antivirus policy; inspect the Windows Defender Application Control policy in the code-integrity store; and confirm no campaign process remains injected into a trusted application.
3. Repair update and recovery controls. Restore wuauserv, UsoSvc, uhssvc and WaaSMedicSvc; validate WaaSMedicSvc.dll and wuaueng.dll; remove unauthorised NoAutoUpdate policy; restore disabled Windows Update tasks; and verify backup integrity following shadow-copy deletion.
4. Scope lateral movement. Review SMB remote-file-access events originating from affected systems, particularly access to administrative shares. Hunt for reuse of affected credentials and payload creation on peer systems.
5. Rebuild where trust cannot be restored. Reimage systems where responders cannot establish the integrity of code-integrity policy, Defender configuration, injected processes or Windows Update components.

P3 — within seven days

1. Restrict software installation to approved repositories and verified vendor portals. Apply application-control policy to prevent execution from user-writable directories where operationally feasible.
2. Run retrospective hunts across the available telemetry-retention period using the hashes, C2 set, delivery domains, randomised path pattern, msiexec.exe -Embedding ... Global\MSI0000, scheduled-task execution and Defender-tampering commands.
3. Review China-based operations, Chinese-speaking user populations and outsourced support teams for downloads of the impersonated software.
4. Test alerting for Defender exclusion changes, shadow-copy deletion, Windows Update service disablement, task creation as SYSTEM, payloads parented by the Task Scheduler service and non-system copies of svchost.exe.

This campaign has no vendor CVE fix or version pin. Remediation requires containment, persistence removal, restoration of impaired controls and prevention of untrusted software downloads.

5. Indicators of compromise

All indicators below are reported by Microsoft only: single-sourced; verify before enforcement. Payload archive hashes rotate per request, and shared cloud infrastructure requires exact-host rather than provider-wide blocking.

domain  pc-razerzone[.]com[.]cn
domain  app-microsoft-edge[.]com[.]cn
domain  kaspersky-lab[.]hl[.]cn
domain  sejda[.]hl[.]cn
domain  translate-youdao[.]hl[.]cn
domain  zh-diskgenius[.]com[.]cn
domain  baidu-pan[.]com[.]cn
domain  ocam-pc[.]com[.]cn
domain  cn-drawio[.]com[.]cn
domain  steelseries-cn[.]com[.]cn
domain  gw-sogou[.]com[.]cn
domain  calibre-ebook[.]com[.]cn
domain  mindmoster[.]com[.]cn
domain  gehie246[.]com
domain  yimxg25tiy[.]com
domain  cc8ttkv35b[.]com
domain  n7b8t85zsg[.]com
domain  bxfh[.]tzcdq[.]cn
domain  tmsq[.]tzcdq[.]cn
domain  mebx78e02[.]com
domain  qwjre1487[.]com
url  hxxps://www[.]gehie246[.]com/712down
domain  upitem[.]oss-cn-hangzhou[.]aliyuncs[.]com
domain  newopt001[.]oss-cn-hongkong[.]aliyuncs[.]com
domain  iualef[.]net
domain  euioxu[.]net
domain  czijbh[.]net
domain  wfmwsj[.]net
domain  tbdqxq[.]net
domain  oijfwe[.]net
ipv4  202[.]95[.]14[.]237
ipv4  47[.]239[.]232[.]245
ipv4  161[.]248[.]87[.]157
ipv4  103[.]156[.]25[.]35
ipv4  103[.]183[.]3[.]162
ipv4  43[.]99[.]100[.]248
ipv4  47[.]239[.]175[.]163
ipv4  47[.]86[.]205[.]97
ipv4  47[.]243[.]218[.]255
sha256  676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
sha256  6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
sha256  c4100ad39d8db98f063feb6c3b6c8e9a9f9d9bf25a1e0233f43b058ff8a7dbdf
sha256  1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17
sha256  c6100166e2d3b40388980f7674712ef39e937ac04925ca5d370415399ed73faf
sha256  f33d160d757e4b39019fdef21cf90cafb501b800ca0d4039366bc30856e3d81b
sha256  e4fe2dee8f0bb132fa15fc686d1f93df39530a2d3a8d3a1f3a605a057c04e7b3

Behavioural indicators

6. Detection

The following rules use only artefacts reported by Microsoft. Validate against local software and administration patterns before production enforcement.

rule AT_2026_09_02_709_Counterfeit_Installer_Payloads
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-02"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/"
        description = "Detects reported counterfeit-installer payload metadata and TrueUpdate artefacts"

    strings:
        $philips_company = "Speech Processing Solutions GmbH" ascii wide
        $philips_description = "Philips Speech Driver Client Configuration" ascii wide
        $philips_original = "PhilipsSpeechDriverConfiguration.exe" ascii wide
        $philips_version = "4.7.471.07" ascii wide
        $philips_product = "TODO: <Product name>" ascii wide
        $philips_dll = "XPSPLOG.dll" ascii wide

        $trueupdate_original = "tu_rt.exe" ascii wide
        $trueupdate_version = "3.8.0.0" ascii wide
        $trueupdate_temp = "_ir_tu2_temp_" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        (
            3 of ($philips_*) or
            2 of ($trueupdate_*)
        )
}

title: Counterfeit Installer Host Impairment and Proxy Execution
description: Detects process activity reported in the counterfeit software installer campaign
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
logsource:
  category: process_creation
  product: windows
detection:
  defender_exclusion:
    CommandLine|contains:

      - 'Windows Defender\Exclusions\Paths'
      - 'Add-MpPreference -ExclusionPath'
  system_task:
    CommandLine|contains|all:

      - 'SCHTASKS'
      - '/RL HIGHEST'
      - '/RU "SYSTEM"'
  shadow_deletion:
    CommandLine|contains:

      - 'vssadmin delete shadows /all /quiet'
  update_impairment:
    CommandLine|contains:

      - 'NoAutoUpdate'
      - 'WaaSMedicSvc'
      - 'wuaueng'
  msiexec_embedding:
    Image|endswith:

      - '\msiexec.exe'
    CommandLine|contains|all:

      - '-Embedding'
      - 'Global\MSI0000'
  condition: defender_exclusion or system_task or shadow_deletion or update_impairment or msiexec_embedding

title: Counterfeit Installer Campaign Command-and-Control
description: Detects reported C2 domains or the reported C2 IP and non-standard port sets
references:

  - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
logsource:
  category: network_connection
  product: windows
detection:
  c2_domain:
    DestinationHostname:

      - 'iualef.net'
      - 'euioxu.net'
      - 'czijbh.net'
      - 'wfmwsj.net'
      - 'tbdqxq.net'
      - 'oijfwe.net'
  c2_ip:
    DestinationIp:

      - '202.95.14.237'
      - '47.239.232.245'
      - '161.248.87.157'
      - '103.156.25.35'
      - '103.183.3.162'
      - '43.99.100.248'
      - '47.239.175.163'
      - '47.86.205.97'
      - '47.243.218.255'
  c2_port:
    DestinationPort:

      - 5090
      - 7031
      - 7032
      - 7088
      - 7089
      - 7090
      - 8050
      - 28290
      - 28300
  condition: c2_domain or (c2_ip and c2_port)

7. Sources

• Microsoft Security Blog, “Counterfeit installers to system compromise: Tracking a deceptive software download campaign”, https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/, 2026-09-01.

8. Adverse Trace position

This is an operationally significant malware campaign, not a vulnerability disclosure: no CVE, CVSS severity or CISA KEV state applies. The demonstrated ability to establish SYSTEM-level persistence, impair Defender and Windows Update, delete recovery data, inject into trusted processes and attempt SMB lateral movement warrants immediate hunting across exposed Windows estates, especially those supporting China-based operations or Chinese-speaking users. Attribution to Silver Fox/Yinhu remains unconfirmed because it rests on Microsoft’s moderate-confidence assessment and neither name has a MITRE ATT&CK actor profile in the verified data. All campaign intelligence and IOCs supplied here are single-sourced; verify before enforcement. Adverse Trace will monitor for independent corroboration, infrastructure rotation, additional payload capability and confirmed impact within EMEA financial services.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.