{"id":2658,"date":"2026-09-02T17:53:56","date_gmt":"2026-09-02T17:53:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2658"},"modified":"2026-09-02T17:53:56","modified_gmt":"2026-09-02T17:53:56","slug":"fake-software-installers-disable-windows-update-and-weaken-microsoft-defender","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2658","title":{"rendered":"Fake Software Installers Disable Windows Update and Weaken Microsoft Defender"},"content":{"rendered":"<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjhKCtgI2bIF4kLY71qjkluS80XAm5YPA9y9GzTxC8XBTaxq1d42jyZ-bxAr7OlZ-wCc4-RDp_NmUPKxd9TS1dvtjt3gysB86SkMuQ5q6vGb7HTh-DVMNC8VJcJFC2sJmiSQ740SX-miCoyiGfkAXLqO1ySH3zenWcAP7g6ilReO9jRsnl3Tnw279K7NYF3\/s1700-nu-rw-lo-l85-e365\/windows-updates.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.<\/p>\n<p>\u00abThe campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users,\u00bb Microsoft <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/09\/01\/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign\/\" target=\"_blank\">said<\/a>.<\/p>\n<p>The installers, once launched, deploy malware that&#8217;s capable of setting up persistence, weakening security protections, and communicating with attacker-controlled infrastructure.<\/p>\n<p>The activity has resulted in victims spanning healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The Windows maker has assessed with moderate confidence that the campaign is consistent with a <a href=\"https:\/\/otx.alienvault.com\/pulse\/6a36fe5a3c1568785b59c4d7\" target=\"_blank\">Chinese threat cluster<\/a> dubbed Silver Fox (aka Yinhu), which has a track record of using spoofed vendor download pages to distribute Gh0st RAT and ValleyRAT (aka WinOS 4.0).<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/trust-world-update-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhYq3TvePXpW0JIC7fXyv7A1W8KQqmb-AZqza2EuPyT0k8Nm5CwHYHISFLKXSKIAyR8JRtqEFQ4zx5jADiAkZKQ08nRWG1jCRV5YAbhKua7WaDdH1L6wsI-xOkoV4brlMfK44UwU-4Q1xqWg0uNN7sZkMCzci4RXYgWMNPHTtuKua7OR4oCbmxE10u0yKnR\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>The websites observed as part of the campaign are hosted on the .com.cn and .hl.cn infrastructure and use Chinese-language lure content to trigger the download of a ZIP archive from \u00abgehie246[.]com.\u00bb Some of the counterfeit websites are listed below &#8211;<\/p>\n<ul>\n<li>app-microsoft-edge[.]com[.]cn<\/li>\n<li>baidu-pan[.]com[.]cn<\/li>\n<li>calibre-ebook[.]com[.]cn<\/li>\n<li>cn-drawio[.]com[.]cn<\/li>\n<li>gw-sogou[.]com[.]cn<\/li>\n<li>kaspersky-lab[.]hl[.]cn<\/li>\n<li>mindmoster[.]com[.]cn<\/li>\n<li>ocam-pc[.]com[.]cn<\/li>\n<li>pc-razerzone[.]com[.]cn<\/li>\n<li>sejda[.]hl[.]cn<\/li>\n<li>steelseries-cn[.]com[.]cn<\/li>\n<li>translate-youdao[.]hl[.]cn<\/li>\n<li>zh-diskgenius[.]com[.]cn<\/li>\n<\/ul>\n<p>The web pages are high-fidelity clones of the legitimate vendor&#8217;s site and feature a prominent download call-to-action. Tellingly, the archive downloaded from the site maintains the same file name while its hash changes on every download, indicating that the payload is generated server-side on the fly for every request.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>Opening the archive leads to a wrapper installer (e.g., \u00aba_instapp83353001.exe\u00bb or \u00abainst8663586104.exe\u00bb), which, upon execution, launches the first stage payload. Separately, Microsoft said it observed a second execution vector that makes use of the trusted Windows Installer service (\u00abmsiexec.exe\u00bb) to launch a randomized executable, mirroring the same masquerade pattern as the wrapper chain.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgu_NhG7agmNGHf-knq6gxQz4dO5VzWYvEdXOGMMZDwIhQ2YtZEysNN_beYTAayGMzvp-T2HXRUux5oa6rfYR2LTG884ELDFsTvgGxijveWoJaKEfgtk4-4Fo1BEAPDLvYr7zYj06wZQVIigOnLPKlU4PrCslKAgHcs8Bdx2-VlXn1HJnxV-y49HuDsktvw\/s1700-nu-rw-lo-l85-e365\/ms-main.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgu_NhG7agmNGHf-knq6gxQz4dO5VzWYvEdXOGMMZDwIhQ2YtZEysNN_beYTAayGMzvp-T2HXRUux5oa6rfYR2LTG884ELDFsTvgGxijveWoJaKEfgtk4-4Fo1BEAPDLvYr7zYj06wZQVIigOnLPKlU4PrCslKAgHcs8Bdx2-VlXn1HJnxV-y49HuDsktvw\/s1700-nu-rw-lo-l85-e365\/ms-main.jpg\" alt=\"\" border=\"0\" data-original-height=\"1098\" data-original-width=\"700\"\/><\/a><\/div>\n<p>Regardless of the method used, persistence is achieved through scheduled tasks that imitate routine IT or productivity jobs. The malware is also responsible for creating a short-lived scheduled task that runs as SYSTEM and configures Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, and ensures payload directories cannot be removed by standard users by modifying their discretionary access control lists (DACLs) using <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/administration\/windows-commands\/icacls\" target=\"_blank\">icacls<\/a>.<\/p>\n<p>In addition, it tampers with Windows Update by stopping and disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming update dynamic-link libraries (DLLs), and deleting the SoftwareDistribution cache.<\/p>\n<p>Once all these steps are carried out, the malware establishes command-and-control (C2) over application-layer protocols on non-standard ports like 5090, 7031, 7032, 7088\u20137090, 8050, 28290, and 28300. Two C2 domains associated with the activity are \u00abiualef[.]net\u00bb and \u00aboijfwe[.]net.\u00bb<\/p>\n<p>It&#8217;s unclear what the end goal of the campaign is, as Microsoft said Defender detected and initiated automated containment procedures through <a href=\"https:\/\/learn.microsoft.com\/en-us\/defender-xdr\/automatic-attack-disruption\" target=\"_blank\">attack disruption<\/a> to limit the attack&#8217;s impact further.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPem0Jebd4RkJRH1cRK_tSeNcnmNKfhSp9kAtuFKB8fgThUU00ySd2Dm0sdJIh3wbWNU3ShLaNM1w1NGsiMcofL71PQmlcHfNkLXbNsz2tLjtZFQkJ2BTCrMft639B_KnGeRUeucYF_G9OCI7sL6hA0ISSCJs18L-OiSuwLfCrStIofRtfh5CG3ggdscen\/s1700-nu-rw-lo-l85-e365\/tasks.jpg\" style=\"clear: left; display: block; float: left;  text-align: center;\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhPem0Jebd4RkJRH1cRK_tSeNcnmNKfhSp9kAtuFKB8fgThUU00ySd2Dm0sdJIh3wbWNU3ShLaNM1w1NGsiMcofL71PQmlcHfNkLXbNsz2tLjtZFQkJ2BTCrMft639B_KnGeRUeucYF_G9OCI7sL6hA0ISSCJs18L-OiSuwLfCrStIofRtfh5CG3ggdscen\/s1700-nu-rw-lo-l85-e365\/tasks.jpg\" alt=\"\" border=\"0\" data-original-height=\"370\" data-original-width=\"975\"\/><\/a><\/div>\n<p>The disclosure comes merely days after Kaspersky detailed a malicious installer that deploys a modified Chinese desktop wallpaper management tool known as QN Wallpaper, while using it to initiate a DLL sideloading chain responsible for delivering ValleyRAT.<\/p>\n<p>\u00abThe original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user,\u00bb Kaspersky <a href=\"https:\/\/securelist.com\/valleyrat-backdoor-adware\/121175\/\" target=\"_blank\">said<\/a>. \u00abIn this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL.\u00bb<\/p>\n<p>The backdoor, besides taking steps to protect its process and prevent it from being terminated, captures keystrokes and clipboard contents, and saves the contents to a file on disk. It also periodically scans for active windows belonging to applications that could be used to analyze processes or traffic.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/event-security-need\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhJkE4t8oCql1wmWVt687J1yD7WnYRqvIpcsUwFSVUO-0HpxZWMCxLmeYwBlz38-C0KD-R6f9Pg0swgPTQuBsNXck_Kl3iKWNSQtyMcDNUSZGhiBd_XFu6U1SQi5LhuW-FHg00iT3CbRCUgMoCwhZevwxp8-9gwM2wZVVtGVO8Z2NbZ5EjVmI2dH4adnSAk\/s728-nu-rw-lo-l85-e365\/Shai-Hulud-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>ValleyRAT is a sophisticated implant with a wide range of features that allows it to collect system information, reboot\/shut down the computer, take screenshots, wipe logs, update C2 addresses, download additional DLL or shellcode modules, and send keylogger logs along with clipboard data.<\/p>\n<p>\u00abThe attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection,\u00bb Kaspersky said. \u00abMotivated by both cyber espionage and financial gain, Silver Fox targets organizations across multiple countries.\u00bb<\/p>\n<p>According to a report <a href=\"https:\/\/expel.com\/blog\/cylindricalcanine-and-cuboidalcanine\/\" target=\"_blank\">published<\/a> by Expel last month, the use of ValleyRAT has also been attributed to a sub-group within GoldenEyeDog known as CuboidalCanine, which is assessed to have moved away from Gh0st RAT \u00abat some point.\u00bb CuboidalCanine, per the cybersecurity company, targets the gambling industry and uses watering holes to distribute the malware by abusing code-signing certificates to bypass security controls.<\/p>\n<p>\u00abThis malware isn&#8217;t unique to any actor, <a href=\"https:\/\/ti.qianxin.com\/blog\/articles\/apt-q-27-gang-recent-use-of-silver-fox-trojan-stealing-activities-en\/\" target=\"_blank\">but has been known to be used by GoldenEyeDog<\/a>,\u00bb security researcher Aaron Walton said. \u00abDue to the source code being public, attribution of this malware to any actor relies on factors other than the malware family itself.\u00bb<\/p>\n<p>In June 2026, Chinese authorities <a href=\"https:\/\/www.gzwxb.gov.cn\/context\/contextId\/216300\" target=\"_blank\">took action<\/a> against a series of cybercrime cases distributing a new variant of the Silver Fox trojan, state media outlet <a href=\"https:\/\/global.chinadaily.com.cn\/a\/202606\/16\/WS6a30cb04a310986e2b460401.html\" target=\"_blank\">China Daily<\/a> reported.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. \u00abThe campaign has targeted users looking to download popular software and has resulted&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2659,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1246,772,150,696,147,588,1029,3273,307],"class_list":["post-2658","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-defender","tag-disable","tag-fake","tag-installers","tag-microsoft","tag-software","tag-update","tag-weaken","tag-windows"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2658"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2658\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2659"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}