Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
Microsoft Defender Experts is tracking an active campaign using spoofed software download sites for brands such as Razer, Kaspersky, Microsoft Edge, Calibre, and Baidu Netdisk on .com.cn and .hl.cn domains, delivering installer archives whose hashes change per download, indicating server-side payload generation. The implants establish persistence, weaken security protections, and communicate with attacker-controlled infrastructure, with confirmed compromises across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence that the activity matches the publicly reported Silver Fox (Yinhu) fake software campaign; it has not attributed it to a nation-state actor.
- Look-alike vendor download pages funnel to shared delivery hosts such as gehie246[.]com and rotating domains.
- Installer archives keep the same filename while hashes change, indicating per-request server-side generation.
- Victims are predominantly China-based operations of multinationals and Chinese-speaking users.
- Microsoft recommends SmartScreen, network protection, tamper protection, and Defender XDR.
- Tags
- chinacounterfeit-installersfake-downloadsmalware-deliverymicrosoftsilver-foxsocial-engineeringyinhu
- Threat actors
- Silver FoxYinhu
- Organizations
- Microsoft
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | app-microsoft-edge.com.cn | c-razerzone[.]com[.]cn Peripherals / drivers Microsoft Edge app-microsoft-edge[.]com[.]cn Browser Kaspersky kaspersky-lab[.]hl[.]cn Security soft |
| domain | baidu-pan.com.cn | s zh-diskgenius[.]com[.]cn Disk utility Baidu Netdisk (Pan) baidu-pan[.]com[.]cn Cloud storage oCam Screen Recorder ocam-pc[.]com[.]cn S |
| domain | calibre-ebook.com.cn | pc-razerzone[.]com[.]cn → hxxp://www.gehie246[.]com/712down calibre-ebook[.]com[.]cn → hxxp://www.gehie246[.]com/712down Brand-impersonation |
| domain | cc8ttkv35b.com | and to rotating delivery hosts ( yimxg25tiy[.]com/73inst , cc8ttkv35b[.]com/7qinst , n7b8t85zsg[.]com/ins711 ) and a suspected attack |
| domain | cn-drawio.com.cn | m Screen Recorder ocam-pc[.]com[.]cn Screen capture draw.io cn-drawio[.]com[.]cn Diagramming SteelSeries steelseries-cn[.]com[.]cn Perip |
| domain | gehie246.com | nd downloading app_setup.6653004.zip from the delivery host gehie246[.]com/712down ; two content-distinct copies of the same-named a |
| domain | gw-sogou.com.cn | ing SteelSeries steelseries-cn[.]com[.]cn Peripherals Sogou gw-sogou[.]com[.]cn Input method Calibre calibre-ebook[.]com[.]cn E-book Mi |
| domain | hl.cn | l, web-tbtool, zh-doubaosrf, ieway-cn (all [.]com[.]cn / [.]hl[.]cn) Various utilities Although these domains impersonate unr |
| domain | kaspersky-lab.hl.cn | alidated hash set is in the indicators of compromise below. kaspersky-lab[.]hl[.]cn → hxxp://www.gehie246[.]com/712down pc-razerzone[.]com[ |
| domain | mindmoster.com.cn | ibre calibre-ebook[.]com[.]cn E-book MindMaster (typosquat) mindmoster[.]com[.]cn Mind-mapping Others pc-codex, jinshan-cibapc, zh-tbtool |
| domain | n7b8t85zsg.com | hosts ( yimxg25tiy[.]com/73inst , cc8ttkv35b[.]com/7qinst , n7b8t85zsg[.]com/ins711 ) and a suspected attacker-controlled Alibaba Clou |
| domain | ocam-pc.com.cn | an) baidu-pan[.]com[.]cn Cloud storage oCam Screen Recorder ocam-pc[.]com[.]cn Screen capture draw.io cn-drawio[.]com[.]cn Diagramming |
| domain | oijfwe.net | led Multiple C:\ProgramData\ payloads 103.183.3[.]162:5090 (oijfwe[.]net) Connection failed Stage-one / persistent payloads Alibab |
| domain | pc-razerzone.com.cn | lemetry captured a device navigating to the fake Razer page pc-razerzone[.]com[.]cn and downloading app_setup.6653004.zip from the delivery |
| domain | sejda.hl.cn | spersky kaspersky-lab[.]hl[.]cn Security software Sejda PDF sejda[.]hl[.]cn Productivity NetEase Youdao Dictionary translate-youdao |
| domain | steelseries-cn.com.cn | apture draw.io cn-drawio[.]com[.]cn Diagramming SteelSeries steelseries-cn[.]com[.]cn Peripherals Sogou gw-sogou[.]com[.]cn Input method Cali |
| domain | translate-youdao.hl.cn | PDF sejda[.]hl[.]cn Productivity NetEase Youdao Dictionary translate-youdao[.]hl[.]cn Translation DiskGenius zh-diskgenius[.]com[.]cn Disk ut |
| domain | www.gehie246.com | ns. pc-razerzone[.]com[.]cn (spoofed Razer download site) → www[.]gehie246[.]com/712down → app_setup.6653004.zip → stage-one loader A de |
| domain | yimxg25tiy.com | nation page that served it and to rotating delivery hosts ( yimxg25tiy[.]com/73inst , cc8ttkv35b[.]com/7qinst , n7b8t85zsg[.]com/ins71 |
| domain | zh-diskgenius.com.cn | ictionary translate-youdao[.]hl[.]cn Translation DiskGenius zh-diskgenius[.]com[.]cn Disk utility Baidu Netdisk (Pan) baidu-pan[.]com[.]cn C |
| ipv4 | 103.156.25.35 | fanged) Result 40gK5T.exe, RhT9aQ.exe (Program Files (x86)) 103.156.25[.]35:7031 Connection failed Multiple C:\ProgramData\ payloads |
| ipv4 | 103.183.3.162 | 35:7031 Connection failed Multiple C:\ProgramData\ payloads 103.183.3[.]162:5090 (oijfwe[.]net) Connection failed Stage-one / persist |
| ipv4 | 202.95.14.237 | q) and IP-and-port endpoints; a primary hub was observed on 202.95.14[.]237 (AS152194, CTG Server Limited). Payloads were observed be |
| ipv4 | 47.239.232.245 | chost.exe (Task Scheduler) 02:44:21.971 NETWORK outbound to 47.239.232[.]245:8050 → FirewallOutboundConnectionBlocked 02:44:24.860 NET |
| sha256 | 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17 | ocessFolderPath C:\ProgramData\.exe InitiatingProcessSHA256 1bd3662d784840e410d2d3c0a1040277f7f549089447359f01e05c2559cb1f17 InitiatingProcessCommandLine ".exe" InitiatingProcessCreati |
| sha256 | 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 | ogram Files (x86)\72q1o6\40gK5T.exe InitiatingProcessSHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8 InitiatingProcessCommandLine "40gK5T.exe" InitiatingProcess |
| url | http://www.gehie246.com/712down | e indicators of compromise below. kaspersky-lab[.]hl[.]cn → hxxp://www.gehie246[.]com/712down pc-razerzone[.]com[.]cn → hxxp://www.gehie246[.]com/712do |
From the original article
10 min read at microsoft.com
An active campaign is impersonating legitimate software vendors to deliver malware through look-alike download pages and regenerated installer archives. Microsoft Defender Experts shares observed attack techniques, Defender XDR detections, indicators of compromise, and practical mitigations to help organizations identify, block, and respond to this threat.
By Microsoft Security Research, Microsoft Defender Experts and Parth Jomadkar · microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.