Silver Fox APT Uses Fake Software Installers to Kill Windows Defender

An active malware campaign attributed with moderate confidence to the China-linked threat cluster Silver Fox (also tracked as Yinhu) is leveraging spoofed software-download pages to distribute Gh0st RAT and ValleyRAT payloads. Microsoft disclosed that the operation primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The lure infrastructure is hosted on .com.cn and .hl.cn domains and features high-fidelity clones of legitimate vendor sites—including impersonations of Microsoft Edge, Baidu Pan, Kaspersky, Calibre, draw.io, Sogou, Razer, SteelSeries, Youdao Translate, and DiskGenius—each pushing a ZIP archive from gehie246[.]com.

The infection chain is engineered for stealth and adaptability. Each download produces a ZIP file with a static name but a unique hash, indicating that payloads are generated server-side per request. Opening the archive executes a wrapper installer (e.g., "a_instapp83353001.exe" or "ainst8663586104.exe") that drops the first-stage malware. A secondary execution path abuses the trusted msiexec.exe Windows Installer service to launch randomized binaries that mirror the same masquerade pattern. Security teams can audit suspicious vendor domains and infrastructure using a WHOIS lookup to expose registration anomalies, or run a port scanner against identified IPs to enumerate exposed services tied to the campaign.

Persistence is established through scheduled tasks disguised as routine IT or productivity jobs. The malware then escalates to run a short-lived SYSTEM task that invokes PowerShell to add Microsoft Defender exclusions, deletes volume shadow copies, and uses icacls to harden payload directories by modifying their DACLs—preventing standard users from cleaning them up. It also disables Windows Update by stopping wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update-related DLLs, and wiping the SoftwareDistribution cache, effectively blinding the host to future patches.

Defenders should hunt for newly created scheduled tasks, unauthorized Defender exclusions, and renamed or missing DLLs under C:\Windows\System32. Network telemetry should flag outbound traffic to the identified .com.cn and .hl.cn hosts, and endpoint policies should restrict msiexec.exe from launching unsigned binaries outside managed software deployment paths. Individual users can verify whether their DNS resolution is being manipulated by adversaries via a DNS leak test, and confirm their browser's exposure surface before downloading any third-party installer advertised through search results or sponsored ads.