# Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites > Microsoft Defender Experts is tracking an active campaign distributing malicious installers through fraudulent software-download sites impersonating vendors such as Razer, Microsoft Edge, Kaspersky, Sejda PDF, DiskGenius, and Baidu Netdisk, targeting Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education. Microsoft assesses with moderate confidence the activity is consistent with the Silver Fox (Yinhu) actor, deploying a multi-stage, self-protecting implant with SYSTEM-level scheduled-task persistence, Defender tampering, and process injection. - **Published:** 2026-09-01T00:00:00Z - **Last reviewed:** 2026-09-01T00:00:00Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2283 - **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-silver-fox-counterfeit-installers-tl-2026-2283.webp?v=1afd83ce (Threadlinqs threat intel: Silver Fox Counterfeit Installer Campaign: Detection & IOCs (TL-2026-2283) — High severity, 26 IOCs, 9 detection rules.) - **ID:** TL-2026-2283 - **Severity:** HIGH - **Category:** MALWARE - **Status:** ACTIVE - **Actor:** Void Arachne - **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below) ## Description Microsoft Defender Experts telemetry surfaced a campaign in which victims searching for common utility software (Razer Synapse, Microsoft Edge, Kaspersky, Sejda PDF, NetEase Youdao, DiskGenius, Baidu Netdisk, oCam, draw.io, SteelSeries, Sogou, Calibre, and a MindMaster typosquat) land on look-alike .com.cn/.hl.cn domains and download a dynamically generated ZIP archive. The archive filename stays constant across downloads (app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.*) while its SHA-256 hash changes on every request, indicating server-side payload regeneration rather than static hosting; Microsoft observed two content-distinct archives with the same filename fetched 69 seconds apart from a single delivery host. Execution proceeds through one of two vectors: a wrapper installer (spawned beneath msedge.exe -> an archive tool such as 7zFM.exe/360zip.exe/WinRAR.exe) that drops a randomly named stage-one payload into C:\Users\Public\\.exe or C:\Program Files (x86)\\.exe; or a Windows Installer proxy vector where msiexec.exe -Embedding E Global\MSI0000 launches the payload from C:\Users\Public\, abusing a signed, trusted binary. The implant then establishes SYSTEM-level persistence by creating a short-lived scheduled task (SCHTASKS /Create /RL HIGHEST /RU "SYSTEM") used only to perform privileged Defender-exclusion and registry writes before deleting itself, and separate disguised recurring scheduled tasks (benign corporate-sounding names, ~60-second re-execution cadence, parent svchost.exe -k netsvcs) that relaunch a copy staged at C:\ProgramData\\.exe. Defense evasion is extensive: broad Add-MpPreference exclusions written to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths covering C:\ProgramData, C:\Users, C:\Program Files (x86), and C:\; vssadmin delete shadows /all /quiet to inhibit recovery; and a coordinated Windows Update neutralization (stopping/disabling wuauserv, UsoSvc, uhssvc, and WaaSMedicSvc, renaming wuaueng.dll/WaaSMedicSvc.dll to *_BAK.dll, deleting the SoftwareDistribution cache, disabling \Microsoft\Windows\WindowsUpdate\* tasks, and setting NoAutoUpdate=1 via HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU). The implant masquerades payload version metadata as a Philips Speech Driver Client Configuration binary (CompanyName "Speech Processing Solutions GmbH"), side-loads malicious DLLs (UxEnhance64.dll at stage one, XPSPLOG.dll at a later stage), hardens its drop directories with icacls, writes a malicious policy to the Windows Defender Application Control code-integrity store, and in one observed instance launched svchost.exe from a non-standard path (D:\hellothere\) rather than C:\Windows\System32\. Process injection via CreateRemoteThread into legitimate user applications is used as an escalation/evasion fallback. For command and control the implant repurposes the legitimate Indigo Rose TrueUpdate Client (tu_rt.exe v3.8.0.0) to retrieve later-stage payloads over TLS 443 from an Alibaba Cloud OSS bucket (upitem.oss-cn-hangzhou.aliyuncs.com; a second bucket, newopt001.oss-cn-hongkong.aliyuncs.com, was observed hosting innstll.1.0.61.zip). A dedicated C2 tier of six-character .net domains and a small set of dedicated IPs communicates over non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300); Microsoft observed interactive hands-on-keyboard activity alongside automated beaconing, and one attempted SMB lateral-movement connection to an additional host that Defender blocked. Infrastructure analysis at the ASN level (AS132839, AS8796) — rather than netblock/geography grouping, which missed the relationship — tied together delivery and C2 hosts spread across otherwise-unrelated hosting and DNS providers. Microsoft assesses with moderate confidence that this activity is consistent with the publicly reported Silver Fox (Yinhu / 银狐) actor and has not attributed it to a nation-state. Independent reporting describes Silver Fox (also tracked as Void Arachne, SwimSnake, and The Great Thief of the Valley) as a China-based actor active since at least 2023 that blurs cybercrime and espionage, consistently using counterfeit-installer and phishing lures against Chinese-speaking targets and deploying malware such as ValleyRAT, Winos 4.0, Sainbox RAT, and the Nidhogg/Hidden rootkits in prior, related campaigns; this specific campaign's stage-one/later-stage/networking/persistence payloads were not publicly named to a known family by Microsoft at time of publication. ## MITRE ATT&CK - T1583.001 Acquire Infrastructure: Domains - T1583.006 Acquire Infrastructure: Web Services - T1204.002 User Execution: Malicious File - T1059.001 Command and Scripting Interpreter: PowerShell - T1059.003 Command and Scripting Interpreter: Windows Command Shell - T1218.007 System Binary Proxy Execution: Msiexec - T1053.005 Scheduled Task/Job: Scheduled Task - T1053.005 Scheduled Task/Job: Scheduled Task - T1685 Disable or Modify Tools - T1036.005 Match Legitimate Resource Name or Location - T1574.001 DLL - T1055 Process Injection - T1222.001 Windows Permissions - T1112 Modify Registry - T1021.002 Remote Services: SMB/Windows Admin Shares - T1490 Inhibit System Recovery - T1489 Service Stop - T1571 Non-Standard Port ## Free detection (Splunk SPL, Microsoft KQL, Sigma) **Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition** (`TL-2026-2283-SPL-002`) Detects the implant's SYSTEM-privileged persistence and defense-evasion stage: SCHTASKS /Create /RL HIGHEST /RU "SYSTEM" task creation, Add-MpPreference/registry writes to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths, vssadmin delete shadows /all /quiet, Windows Update service (wuauserv/UsoSvc/uhssvc/WaaSMedicSvc) disruption, icacls hardening of C:\ProgramData/C:\Users\Public drop directories, UxEnhance64.dll/XPSPLOG.dll side-loading, and CreateRemoteThread process injection from staged payload directories. - **Languages:** Splunk SPL, Microsoft KQL, Sigma - **ATT&CK:** T1053.005, T1562.001, T1490, T1489, T1112, T1222.001, T1574.002, T1055 - **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint - **Severity:** critical - **Confidence:** high ### Splunk SPL ```spl index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7 OR EventCode=8 OR EventCode=13) earliest=-24h | eval schtask_system=if(EventCode=1 AND match(Image,"(?i)\\\\schtasks\.exe$") AND match(CommandLine,"(?i)/create") AND match(CommandLine,"(?i)/rl\s+highest") AND match(CommandLine,"(?i)/ru\s+\"?system\"?"),1,0) | eval defender_exclusion_reg=if(EventCode=13 AND match(TargetObject,"(?i)Windows Defender\\\\Exclusions\\\\Paths"),1,0) | eval mppref_exclusion=if(EventCode=1 AND match(CommandLine,"(?i)Add-MpPreference") AND match(CommandLine,"(?i)-ExclusionPath"),1,0) | eval shadow_delete=if(EventCode=1 AND match(Image,"(?i)\\\\vssadmin\.exe$") AND match(CommandLine,"(?i)delete\s+shadows") AND match(CommandLine,"(?i)/all") AND match(CommandLine,"(?i)/quiet"),1,0) | eval wu_service_stop=if(EventCode=1 AND match(Image,"(?i)\\\\(sc|net1?)\.exe$") AND match(CommandLine,"(?i)(wuauserv|UsoSvc|uhssvc|WaaSMedicSvc)"),1,0) | eval icacls_hardening=if(EventCode=1 AND match(Image,"(?i)\\\\icacls\.exe$") AND match(CommandLine,"(?i)(ProgramData|Users\\\\Public)"),1,0) | eval dll_sideload=if(EventCode=7 AND match(ImageLoaded,"(?i)\\\\(UxEnhance64|XPSPLOG)\.dll$"),1,0) | eval remote_thread_inject=if(EventCode=8 AND match(SourceImage,"(?i)^C:\\\\(ProgramData|Users\\\\Public)\\\\"),1,0) | where schtask_system=1 OR defender_exclusion_reg=1 OR mppref_exclusion=1 OR shadow_delete=1 OR wu_service_stop=1 OR icacls_hardening=1 OR dll_sideload=1 OR remote_thread_inject=1 | table _time ComputerName User Image CommandLine TargetObject Details ImageLoaded SourceImage TargetImage schtask_system defender_exclusion_reg mppref_exclusion shadow_delete wu_service_stop icacls_hardening dll_sideload remote_thread_inject | sort -_time ``` ### Microsoft KQL ```kql let SchTaskSystem = DeviceProcessEvents | where Timestamp > ago(24h) | where FileName =~ "schtasks.exe" | where ProcessCommandLine has "/create" and ProcessCommandLine has "highest" and ProcessCommandLine has "SYSTEM" | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "ScheduledTaskSystemPersistence"; let DefenderExclusion = DeviceRegistryEvents | where Timestamp > ago(24h) | where RegistryKey has @"Windows Defender\Exclusions\Paths" | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = RegistryValueData, DetectionType = "DefenderExclusionWrite"; let ShadowDelete = DeviceProcessEvents | where Timestamp > ago(24h) | where FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows" and ProcessCommandLine has "/quiet" | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "ShadowCopyDeletion"; let WUServiceStop = DeviceProcessEvents | where Timestamp > ago(24h) | where FileName in~ ("sc.exe","net.exe","net1.exe") | where ProcessCommandLine has_any ("wuauserv","UsoSvc","uhssvc","WaaSMedicSvc") | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, DetectionType = "WindowsUpdateServiceDisruption"; let DllSideload = DeviceImageLoadEvents | where Timestamp > ago(24h) | where FileName in~ ("UxEnhance64.dll","XPSPLOG.dll") | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, ProcessCommandLine = InitiatingProcessFolderPath, DetectionType = "MaliciousDllSideload"; let RemoteThreadInject = DeviceEvents | where Timestamp > ago(24h) | where ActionType has "ProcessInjection" | where InitiatingProcessFolderPath has_any (@"\ProgramData\", @"\Users\Public\") | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, DetectionType = "RemoteThreadProcessInjection"; SchTaskSystem | union DefenderExclusion, ShadowDelete, WUServiceStop, DllSideload, RemoteThreadInject | sort by Timestamp desc ``` ### Sigma ```yaml title: Silver Fox SYSTEM-Level Scheduled Task Persistence and Defender Exclusion Abuse id: 3d9f6b21-9a54-4d3e-8b7f-1e2c9d4a6b02 status: experimental description: Detects SYSTEM-privileged scheduled task creation, PowerShell Defender exclusion additions, shadow copy deletion, Windows Update service disruption, and drop-directory ACL hardening consistent with the Silver Fox counterfeit-installer implant's persistence and defense-evasion stage. DLL side-loading (UxEnhance64.dll/XPSPLOG.dll) and CreateRemoteThread process injection observed in this campaign require the paired image-load/process-injection detections (SPL/KQL) for coverage since they are not expressible in a single process_creation logsource. references: - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/ author: AII-Detector -- ThreadLinqs Intelligence date: 2026-09-01 tags: - attack.persistence - attack.t1053.005 - attack.defense-evasion - attack.t1562.001 - attack.impact - attack.t1490 - attack.t1489 - attack.t1112 - attack.t1222.001 - attack.tool.silver_fox logsource: category: process_creation product: windows detection: selection_schtask_system: Image|endswith: '\schtasks.exe' CommandLine|contains|all: - '/create' - '/rl' - 'HIGHEST' - 'SYSTEM' selection_mppref_exclusion: CommandLine|contains|all: - 'Add-MpPreference' - '-ExclusionPath' selection_shadow_delete: Image|endswith: '\vssadmin.exe' CommandLine|contains|all: - 'delete' - 'shadows' - '/quiet' selection_wu_disruption: Image|endswith: - '\sc.exe' - '\net.exe' - '\net1.exe' CommandLine|contains: - 'wuauserv' - 'UsoSvc' - 'uhssvc' - 'WaaSMedicSvc' selection_icacls_hardening: Image|endswith: '\icacls.exe' CommandLine|contains: - 'ProgramData' - 'Users\Public' condition: 1 of selection_* falsepositives: - Endpoint security or backup software legitimately creating SYSTEM scheduled tasks or invoking vssadmin - IT administration scripts adding Defender exclusions for approved line-of-business software level: high ``` **Known false positives:** - Endpoint security/backup software legitimately creating SYSTEM-context scheduled tasks or invoking vssadmin as part of normal operation - IT administration scripts adding Defender exclusions for approved line-of-business software or dev environments **Tuning notes:** Allowlist known EDR/backup vendor signed binaries that legitimately issue vssadmin/schtacks SYSTEM commands; correlate the disguised recurring scheduled tasks by their ~60-second re-execution cadence and svchost.exe -k netsvcs parentage rather than by name alone, since the corporate-sounding task names rotate per campaign wave. ### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds - Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade (locked: unlock with TL Creds) - Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition (locked: unlock with TL Creds) - Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 (locked: unlock with TL Creds) - Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade (locked: unlock with TL Creds) - Silver Fox SYSTEM Scheduled-Task Persistence, Defender-Exclusion Abuse & Recovery Inhibition (locked: unlock with TL Creds) - Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 (locked: unlock with TL Creds) - Silver Fox Wrapper-Install Chain, Msiexec Proxy Execution & Philips Driver Masquerade (locked: unlock with TL Creds) - Silver Fox C2 Beaconing via Repurposed TrueUpdate Client, Alibaba OSS Staging & Non-Standard Port C2 (locked: unlock with TL Creds) Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup ## Sample indicators (3 of 26) Defanged, TLP:CLEAR. - IP address: `202.95.14[.]237` - Domain: `pc-razerzone[.]com[.]cn` - URL: `hxxps://newopt001[.]oss-cn-hongkong[.]aliyuncs[.]com/innstll.1.0.61.zip` Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds ## Sources - [Counterfeit installers to system compromise: Tracking a deceptive software download campaign](https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/) - [Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit](https://thehackernews.com/2025/06/chinese-group-silver-fox-uses-fake.html) - [Inside Silver Fox's Den: Trustwave SpiderLabs Unmasks a Global Threat Actor](https://www.levelblue.com/en-us/resources/blogs/trustwave-blog/inside-silver-foxs-den-trustwave-spiderlabs-unmasks-a-global-threat-actor/) - [Silver Fox's Russian Ruse: ValleyRAT Hits China via Fake Microsoft Teams Attack](https://reliaquest.com/blog/threat-spotlight-silver-foxs-russian-ruse-fake-microsoft-teams-attack/) - [New Silver Fox Campaign Uses Fake Tax Audit Alerts and Software Updates to Deliver Malware](https://cybersecuritynews.com/new-silver-fox-campaign-uses-fake-tax-audit-alerts/) ## Full data The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-2283