Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites

Key facts for Silver Fox counterfeit installers

Detection coverage for Silver Fox counterfeit installers

As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2283 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition

Detects the implant's SYSTEM-privileged persistence and defense-evasion stage: SCHTASKS /Create /RL HIGHEST /RU "SYSTEM" task creation, Add-MpPreference/registry writes to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths, vssadmin delete shadows /all /quiet, Windows Update service (wuauserv/UsoSvc/uhssvc/WaaSMedicSvc) disruption, icacls hardening of C:\ProgramData/C:\Users\Public drop directories, UxEnhance64.dll/XPSPLOG.dll side-loading, and CreateRemoteThread process injection from staged payload directories.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1562.001, T1490, T1489, T1112, T1222.001, T1574.002, T1055
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=8 OR EventCode=13) earliest=-24h
| eval schtask_system=if(EventCode=1 AND match(Image,"(?i)\\\\schtasks\.exe$") AND match(CommandLine,"(?i)/create") AND match(CommandLine,"(?i)/rl\s+highest") AND match(CommandLine,"(?i)/ru\s+\"?system\"?"),1,0)
| eval defender_exclusion_reg=if(EventCode=13 AND match(TargetObject,"(?i)Windows Defender\\\\Exclusions\\\\Paths"),1,0)
| eval mppref_exclusion=if(EventCode=1 AND match(CommandLine,"(?i)Add-MpPreference") AND match(CommandLine,"(?i)-ExclusionPath"),1,0)
| eval shadow_delete=if(EventCode=1 AND match(Image,"(?i)\\\\vssadmin\.exe$") AND match(CommandLine,"(?i)delete\s+shadows") AND match(CommandLine,"(?i)/all") AND match(CommandLine,"(?i)/quiet"),1,0)
| eval wu_service_stop=if(EventCode=1 AND match(Image,"(?i)\\\\(sc|net1?)\.exe$") AND match(CommandLine,"(?i)(wuauserv|UsoSvc|uhssvc|WaaSMedicSvc)"),1,0)
| eval icacls_hardening=if(EventCode=1 AND match(Image,"(?i)\\\\icacls\.exe$") AND match(CommandLine,"(?i)(ProgramData|Users\\\\Public)"),1,0)
| eval dll_sideload=if(EventCode=7 AND match(ImageLoaded,"(?i)\\\\(UxEnhance64|XPSPLOG)\.dll$"),1,0)
| eval remote_thread_inject=if(EventCode=8 AND match(SourceImage,"(?i)^C:\\\\(ProgramData|Users\\\\Public)\\\\"),1,0)
| where schtask_system=1 OR defender_exclusion_reg=1 OR mppref_exclusion=1 OR shadow_delete=1 OR wu_service_stop=1 OR icacls_hardening=1 OR dll_sideload=1 OR remote_thread_inject=1
| table _time ComputerName User Image CommandLine TargetObject Details ImageLoaded SourceImage TargetImage schtask_system defender_exclusion_reg mppref_exclusion shadow_delete wu_service_stop icacls_hardening dll_sideload remote_thread_inject
| sort -_time

Microsoft KQL

let SchTaskSystem = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has "/create" and ProcessCommandLine has "highest" and ProcessCommandLine has "SYSTEM"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "ScheduledTaskSystemPersistence";
let DefenderExclusion = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Windows Defender\Exclusions\Paths"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = RegistryValueData, DetectionType = "DefenderExclusionWrite";
let ShadowDelete = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows" and ProcessCommandLine has "/quiet"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "ShadowCopyDeletion";
let WUServiceStop = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sc.exe","net.exe","net1.exe")
| where ProcessCommandLine has_any ("wuauserv","UsoSvc","uhssvc","WaaSMedicSvc")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "WindowsUpdateServiceDisruption";
let DllSideload = DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName in~ ("UxEnhance64.dll","XPSPLOG.dll")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, ProcessCommandLine = InitiatingProcessFolderPath, DetectionType = "MaliciousDllSideload";
let RemoteThreadInject = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType has "ProcessInjection"
| where InitiatingProcessFolderPath has_any (@"\ProgramData\", @"\Users\Public\")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, DetectionType = "RemoteThreadProcessInjection";
SchTaskSystem
| union DefenderExclusion, ShadowDelete, WUServiceStop, DllSideload, RemoteThreadInject
| sort by Timestamp desc

Sigma

title: Silver Fox SYSTEM-Level Scheduled Task Persistence and Defender Exclusion Abuse
id: 3d9f6b21-9a54-4d3e-8b7f-1e2c9d4a6b02
status: experimental
description: Detects SYSTEM-privileged scheduled task creation, PowerShell Defender exclusion additions, shadow copy deletion, Windows Update service disruption, and drop-directory ACL hardening consistent with the Silver Fox counterfeit-installer implant's persistence and defense-evasion stage. DLL side-loading (UxEnhance64.dll/XPSPLOG.dll) and CreateRemoteThread process injection observed in this campaign require the paired image-load/process-injection detections (SPL/KQL) for coverage since they are not expressible in a single process_creation logsource.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-09-01
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.defense-evasion
    - attack.t1562.001
    - attack.impact
    - attack.t1490
    - attack.t1489
    - attack.t1112
    - attack.t1222.001
    - attack.tool.silver_fox
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtask_system:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - '/create'
            - '/rl'
            - 'HIGHEST'
            - 'SYSTEM'
    selection_mppref_exclusion:
        CommandLine|contains|all:
            - 'Add-MpPreference'
            - '-ExclusionPath'
    selection_shadow_delete:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
            - '/quiet'
    selection_wu_disruption:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
        CommandLine|contains:
            - 'wuauserv'
            - 'UsoSvc'
            - 'uhssvc'
            - 'WaaSMedicSvc'
    selection_icacls_hardening:
        Image|endswith: '\icacls.exe'
        CommandLine|contains:
            - 'ProgramData'
            - 'Users\Public'
    condition: 1 of selection_*
falsepositives:
    - Endpoint security or backup software legitimately creating SYSTEM scheduled tasks or invoking vssadmin
    - IT administration scripts adding Defender exclusions for approved line-of-business software
level: high

Known false positives:

• Endpoint security/backup software legitimately creating SYSTEM-context scheduled tasks or invoking vssadmin as part of normal operation
• IT administration scripts adding Defender exclusions for approved line-of-business software or dev environments

Tuning notes: Allowlist known EDR/backup vendor signed binaries that legitimately issue vssadmin/schtacks SYSTEM commands; correlate the disguised recurring scheduled tasks by their ~60-second re-execution cadence and svchost.exe -k netsvcs parentage rather than by name alone, since the corporate-sounding task names rotate per campaign wave.

• 🔒 Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade · unlock with TL Creds
• 🔒 Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition · unlock with TL Creds
• 🔒 Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 · unlock with TL Creds
• 🔒 Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade · unlock with TL Creds
• 🔒 Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition · unlock with TL Creds
• 🔒 Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 · unlock with TL Creds
• 🔒 Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade · unlock with TL Creds
• 🔒 Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 · unlock with TL Creds

Indicators of compromise for Silver Fox counterfeit installers

As of 2026-09-01, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2283.

Sample indicators (3 of 26)

• IP address: 202.95.14[.]237
• Domain: pc-razerzone[.]com[.]cn
• URL: hxxps://newopt001[.]oss-cn-hongkong[.]aliyuncs[.]com/innstll.1.0.61.zip

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

Community OSINT corroboration for Silver Fox counterfeit installers

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Silver Fox counterfeit installers works

Microsoft assesses with moderate confidence the activity is consistent with the Silver Fox (Yinhu) actor, deploying a multi-stage, self-protecting implant with SYSTEM-level scheduled-task persistence, Defender tampering, and process injection.

Microsoft Defender Experts telemetry surfaced a campaign in which victims searching for common utility software (Razer Synapse, Microsoft Edge, Kaspersky, Sejda PDF, NetEase Youdao, DiskGenius, Baidu Netdisk, oCam, draw.io, SteelSeries, Sogou, Calibre, and a MindMaster typosquat) land on look-alike .com.cn/.hl.cn domains and download a dynamically generated ZIP archive. The archive filename stays constant across downloads (app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.*) while its SHA-256 hash changes on every request, indicating server-side payload regeneration rather than static hosting; Microsoft observed two content-distinct archives with the same filename fetched 69 seconds apart from a single delivery host.

Execution proceeds through one of two vectors: a wrapper installer (spawned beneath msedge.exe -> an archive tool such as 7zFM.exe/360zip.exe/WinRAR.exe) that drops a randomly named stage-one payload into C:\Users\Public\<random>\<random>.exe or C:\Program Files (x86)\<random>\<random>.exe; or a Windows Installer proxy vector where msiexec.exe -Embedding E Global\MSI0000 launches the payload from C:\Users\Public\, abusing a signed, trusted binary. The implant then establishes SYSTEM-level persistence by creating a short-lived scheduled task (SCHTASKS /Create /RL HIGHEST /RU "SYSTEM") used only to perform privileged Defender-exclusion and registry writes before deleting itself, and separate disguised recurring scheduled tasks (benign corporate-sounding names, ~60-second re-execution cadence, parent svchost.exe -k netsvcs) that relaunch a copy staged at C:\ProgramData\<random>\<random>.exe.

Defense evasion is extensive: broad Add-MpPreference exclusions written to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths covering C:\ProgramData, C:\Users, C:\Program Files (x86), and C:\; vssadmin delete shadows /all /quiet to inhibit recovery; and a coordinated Windows Update neutralization (stopping/disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming wuaueng.dll/WaaSMedicSvc.dll to *_BAK.dll, deleting the SoftwareDistribution cache, disabling \Microsoft\Windows\WindowsUpdate\* tasks, and setting NoAutoUpdate=1 via HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU). The implant masquerades payload version metadata as a Philips Speech Driver Client Configuration binary (CompanyName "Speech Processing Solutions GmbH"), side-loads malicious DLLs (UxEnhance64.dll at stage one, XPSPLOG.dll at a later stage), hardens its drop directories with icacls, writes a malicious policy to the Windows Defender Application Control code-integrity store, and in one observed instance launched svchost.exe from a non-standard path (D:\hellothere\) rather than C:\Windows\System32\. Process injection via CreateRemoteThread into legitimate user applications is used as an escalation/evasion fallback.

For command and control the implant repurposes the legitimate Indigo Rose TrueUpdate Client (tu_rt.exe v3.8.0.0) to retrieve later-stage payloads over TLS 443 from an Alibaba Cloud OSS bucket (upitem.oss-cn-hangzhou.aliyuncs.com; a second bucket, newopt001.oss-cn-hongkong.aliyuncs.com, was observed hosting innstll.1.0.61.zip). A dedicated C2 tier of six-character .net domains and a small set of dedicated IPs communicates over non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300); Microsoft observed interactive hands-on-keyboard activity alongside automated beaconing, and one attempted SMB lateral-movement connection to an additional host that Defender blocked. Infrastructure analysis at the ASN level (AS132839, AS8796) — rather than netblock/geography grouping, which missed the relationship — tied together delivery and C2 hosts spread across otherwise-unrelated hosting and DNS providers.

Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (Yinhu / 银狐) actor and has not attributed it to a nation-state. Independent reporting describes Silver Fox (also tracked as Void Arachne, SwimSnake, and The Great Thief of the Valley) as a China-based actor active since at least 2023 that blurs cybercrime and espionage, consistently using counterfeit-installer and phishing lures against Chinese-speaking targets and deploying malware such as ValleyRAT, Winos 4.0, Sainbox RAT, and the Nidhogg/Hidden rootkits in prior, related campaigns; this specific campaign's stage-one/later-stage/networking/persistence payloads were not publicly named to a known family by Microsoft at time of publication.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Privilege Escalation

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File

defense-impairment

T1112 Modify Registry; T1222.001 Windows Permissions; T1685 Disable or Modify Tools

stealth

T1218.007 System Binary Proxy Execution: Msiexec

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Command and Control

T1571 Non-Standard Port

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services

Remediation for Silver Fox counterfeit installers

Immediate actions

• Enable Tamper Protection so SYSTEM-privileged writes to Microsoft Defender Antivirus exclusion lists are blocked, not just user-level writes
• Block download/execution of ZIP archives named app_setup.*, zinst.*, zintall.*, intsoft.*, or innstll.* originating from *.com.cn or *.hl.cn brand-lookalike domains
• Block network egress to the identified C2 domains and IP:port pairs (ports 5090, 7031, 7032, 7088-7090, 8050, 28290, 28300) at the proxy/firewall
• Hunt for and terminate scheduled tasks with generic corporate-sounding names re-executing on a ~60-second cadence and launching binaries from C:\ProgramData\<random>\<random>.exe

Workarounds

• Use WDAC/AppLocker to restrict msiexec.exe -Embedding proxy execution of payloads from user-writable paths (C:\Users\Public, C:\ProgramData)
• Restrict icacls modification rights on C:\ProgramData and C:\Users\Public to prevent the implant from hardening its own drop directories

Longer-term hardening

• Enable Defender Attack Surface Reduction rules that block untrusted/unsigned executables, obfuscated script execution, and copied or impersonated system tools
• Deploy Defender for Endpoint with Attack Disruption enabled to auto-contain C2 connections and hands-on-keyboard activity
• Correlate FileOriginUrl/FileOriginReferrerUrl telemetry to link landing-page domains to delivery hosts as the campaign's infrastructure rotates
• Educate Chinese-speaking user populations against downloading utility software outside official vendor domains; enforce an application allowlist for common installer categories

Affected and fixed versions

• Microsoft — Windows (client and server, all currently supported versions)
  Vulnerable versions: Not a software vulnerability — social-engineering-driven installer campaign affecting any Windows host where a user executes the counterfeit installer

Timeline of Silver Fox counterfeit installers

• 2023-01-01 Silver Fox (Yinhu / Void Arachne / The Great Thief of the Valley) documented as active since at least 2023, per Trustwave SpiderLabs research.
• 2025-06-27 The Hacker News reports a related Silver Fox campaign using fake vendor websites to deliver Sainbox RAT (a Gh0st RAT variant) and a Hidden open-source rootkit via side-loaded libcef.dll.
• 2025-08-05 Trustwave SpiderLabs publishes 'Inside Silver Fox's Den,' documenting the actor's malware arsenal (ValleyRAT, Winos 4.0, Sainbox RAT, Nidhogg/Hidden rootkits) and dual espionage/financial motivation.
• 2025-12-04 ReliaQuest reports Silver Fox distributing ValleyRAT via a fake Microsoft Teams installer (teamscn[.]com) using Cyrillic-character false-flag tradecraft to mislead attribution toward a Russian actor.
• 2026-04-28 Cyber Security News reports a Silver Fox campaign using fake tax-audit alerts and software-update lures to deliver ValleyRAT, AtlasCross RAT, and a Catena loader via BYOVD kernel-level EDR/AV disabling.
• 2026-07-15 Microsoft Defender Experts telemetry begins capturing execution of this counterfeit-installer campaign's stage-one and later-stage payloads (observed intra-day execution timestamps 02:44:20-08:38:51 in single cycles); exact start date approximate, per Microsoft's July 2026 observation window.
• 2026-09-01 Microsoft Security Blog publishes 'Counterfeit installers to system compromise: Tracking a deceptive software download campaign,' attributing the activity with moderate confidence to Silver Fox and releasing full IOC set and hunting queries.

Sources cited for Silver Fox counterfeit installers

• Counterfeit installers to system compromise: Tracking a deceptive software download campaign Microsoft · Vendor report · 2026-09-01
• Inside Silver Fox's Den: Trustwave SpiderLabs Unmasks a Global Threat Actor levelblue.com · Research · 2025-08-05
• Silver Fox's Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack reliaquest.com · Blog · 2025-12-04
• Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit The Hacker News · News · 2025-06-27
• New Silver Fox Campaign Uses Fake Tax Audit Alerts and Software Updates to Deliver Malware cybersecuritynews.com · News · 2026-04-28

Threats related to Silver Fox counterfeit installers

• HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation
• ClickFix Cluster Uses DLL Sideloading and Compromised WordPress Sites to Deliver Lorem Ipsum Loader, Linked to Vanilla Tempest
• EtherRAT: Node.js Remote Access Trojan with Ethereum Blockchain C2 Resolution and Per-Execution Self-Reobfuscation
• SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor

More from Void Arachne

• AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate
• SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows Defenses
• ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading
• SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD
• AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver Fox Overlap)
• SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer

Previous and next in malware

• Chinese-Speaking Threat Actors Deploy PanDa Android RAT Against Mexican Banking Users via Meta Ads Malvertising Previous report
• Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing Next report