hacker-news · Crawled Sep 2, 2026
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
18 IoCs 1 Actors 2 Malware
Read original article ↗
AI Summary
A malware campaign attributed to the Chinese threat cluster Silver Fox (aka Yinhu) is distributing malicious fake software installers through spoofed vendor websites, primarily targeting Chinese-speaking users and multinational organizations in China. The installers deploy Gh0st RAT and ValleyRAT, which disable Windows Update services, weaken Microsoft Defender, and establish command-and-control communication via non-standard ports. The payloads use DLL sideloading and masquerade as legitimate installers to bypass security controls, enabling keystroke logging, clipboard theft, and remote system control.
AI-extracted · verify before operational use
Extracted Entities 3 found
Indicators of Compromise 18 extracted
| Type | Value | Detail |
|---|---|---|
| Domain | gehie246[.]com | Details → |
| Domain | iualef[.]net | Details → |
| Domain | oijfwe[.]net | Details → |
| Domain | app-microsoft-edge[.]com[.]cn | Details → |
| Domain | baidu-pan[.]com[.]cn | Details → |
| Domain | calibre-ebook[.]com[.]cn | Details → |
| Domain | cn-drawio[.]com[.]cn | Details → |
| Domain | gw-sogou[.]com[.]cn | Details → |
| Domain | kaspersky-lab[.]hl[.]cn | Details → |
| Domain | mindmoster[.]com[.]cn | Details → |
| Domain | ocam-pc[.]com[.]cn | Details → |
| Domain | pc-razerzone[.]com[.]cn | Details → |
| Domain | sejda[.]hl[.]cn | Details → |
| Domain | steelseries-cn[.]com[.]cn | Details → |
| Domain | translate-youdao[.]hl[.]cn | Details → |
| Domain | zh-diskgenius[.]com[.]cn | Details → |
| Filename | a_instapp83353001.exe | Details → |
| Filename | ainst8663586104.exe | Details → |
MITRE ATT&CK TTPs 49 techniques
T1005 Data from Local System · Collection T1006 Direct Volume Access · Defense Evasion T1012 Query Registry · Discovery T1014 Rootkit · Defense Evasion T1021 Remote Services · Lateral Movement T1021.006 Windows Remote Management · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1036 Masquerading · Defense Evasion T1053 Scheduled Task/Job · Execution T1053.003 Cron · Execution T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.005 Thread Local Storage · Defense Evasion T1055.012 Process Hollowing · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.003 Clear Command History · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1085 T1085 T1089 T1089 T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1113 Screen Capture · Collection T1129 Shared Modules · Execution T1132.001 Standard Encoding · Command And Control T1133 External Remote Services · Persistence T1136 Create Account · Persistence T1176 Browser Extensions · Persistence T1190 Exploit Public-Facing Application · Initial Access T1204.002 Malicious File · Execution T1213 Data from Information Repositories · Collection T1213.001 Confluence · Collection T1543.001 Launch Agent · Persistence T1548 Abuse Elevation Control Mechanism · Privilege Escalation T1548.002 Bypass User Account Control · Privilege Escalation T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1574.002 DLL Side-Loading · Persistence T1036.005 Match Legitimate Name or Location · Defense Evasion T1059.003 Windows Command Shell · Execution T1112 Modify Registry · Defense Evasion T1134.001 Token Impersonation/Theft · Defense Evasion T1484.002 Trust Modification · Defense Evasion