QuickFox Supply Chain Attack Deploys FDMTP Implant via Trojanized VPN Proxy/Game Accelerator — Threadlinqs Intelligence
As of 2026-08-04, QuickFox Supply Chain Attack Deploys FDMTP Implant via Trojanized VPN Proxy/Game Accelerator is a medium-severity supply chain threat attributed to Mustang Panda (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 31 indicators of compromise.
Threat ID: TL-2026-1864 · Severity: MEDIUM · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: Mustang Panda · China · ESPIONAGE
FortiGuard Labs reports a supply chain compromise of the QuickFox VPN proxy and game accelerator (targeting Chinese users abroad) where trojanized versions of the Windows installer deliver a
QuickFox is a 'return-to-China accelerator' VPN and game acceleration service used by overseas Chinese, international students, and business travelers to access Chinese-licensed content, games, and websites from abroad. Between approximately July 2025 and August 2025, the official QuickFox Windows installer (versions v3.51.0 through v3.59.5) was trojanized with two lines of malicious JavaScript injected into the Electron renderer HTML file at the path <executable>/<version>.7z/resources/app.asar/candy/core/service/index.html.
Upon execution, the trojanized QuickFox installer downloads two JavaScript files from the typosquatted domain cdns3[.]51quickfox[.]cn: a legitimate Firebase decoy (firebase-analytics-compat.js) and a heavily obfuscated malicious loader (firebase-app-compat.js). The malicious loader employs a custom obfuscation scheme with ten parallel layers of base91 decryption using distinct 91-character alphabets and flow obfuscation via nested switch statements.
The loader performs endpoint fingerprinting: it verifies the system is Windows, checks a file-based mutex at %APPDATA%\Local\Temp\quickfox\updated\data.dat (1-byte file indicating prior infection), and enumerates running processes. Critically, the loader exits if steam.exe (Steam gaming platform) is found, indicating a guardrail to avoid gaming PCs and target corporate/work environments. The loader scans for 26 other target process names associated with corporate/developer tools (SSH clients like Xshell, FinalShell, MobaXterm; IDEs like IntelliJ IDEA, VS Code, Sublime Text; database tools like Navicat, DBeaver), cryptocurrency wallets (Exodus, Binance Desktop, Ledger Live, Trezor Suite), messaging platforms (Telegram, SafeW), and Chinese translation/cross-border e-commerce software.
If the guardrail checks pass, the loader downloads update.zip from the typosquat domain to %TEMP%\quickfox\update.zip. The archive is extracted to %APPDATA%\Local\Temp\quickfox\updated\, containing csmonitor.exe (a legitimate Microsoft Azure Compute and Storage Emulator binary used for DLL sideloading) and the malicious Microsoft.ServiceHosting.Tools.dll.
Two generations of the payload have been observed:
Generation 1 (circa September 2025): The malicious DLL contains the FDMTP payload as an embedded byte array within a .NET assembly. The embedded Client.dll is instantiated via the DevStore class as a new thread within the csmonitor.exe process. SHA256: 2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C.
Generation 2 (circa May 2026): The malicious DLL is obfuscated using the JieJie .NET Protector tool and decrypts a separate update.bin file via AES-128-ECB using the hardcoded key POt_L[Bsh0=+@0a. This decryption key matches prior Darktrace reporting on FDMTP campaigns attributed to Twill Typhoon. SHA256: 795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9.
The FDMTP implant (version 3.2.5.1) is a .NET backdoor built on the TouchSocket DMTP (Duplex Message Transport Protocol) networking library. It contains 15 compressed modules in its resources section, with the main orchestration module being Client.FDMTPFrame.dll. On execution, it performs C2 registration via an HTTP GET request to /GetCluster?protocol=DotNet-TcpFDMTP&tag=<campaign> on the staging domain (observed: www[.]icloud-cdn[.]net), receiving a Base64-encoded, gzip-compressed list of IP:port endpoints for subsequent FDMTP communication on ports 20800-20816.
The implant collects extensive system information including window titles, installed antivirus products, .NET Framework version, network configuration, MAC address, OS version, installation date, username, and process lists. It supports a modular plugin architecture with observed plugins for scheduled task persistence (Persist.WpTask.dll), registry persistence (Persist.registry.dll), COM hijacking for framework persistence (Persist.extra.dll), and remote file/process manipulation (Assist.dll). Plugin executables are stored compressed
Weaknesses (CWE)
CWE-494, CWE-1104
Target sectors: technology, finance, education, government administration, cryptocurrency
Target regions: East Asia, Southeast Asia, Asia-Pacific, North America, Europe, Oceania
Detections & IOCs
As of 2026-08-07, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 31 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, MEDIUM, threat intelligence, cybersecurity, T1195, T1059, T1204, T1106, T1053, T1546, T1112, T1574, T1036, T1480
