SilverFox (Yinhu) Fake Software Download Sites Deliver Per-Request Malware Installers and Weaken Windows Defenses

Key facts

Detection coverage

As of 2026-09-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2773 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Silver Fox Host Weakening: Defender Exclusions, Shadow Copy Deletion and Windows Update Disablement

Detects the pre-hands-on defense-impairment burst of the Silver Fox fake-installer campaign: Add-MpPreference -ExclusionPath, vssadmin delete shadows, stopping/disabling wuauserv, UsoSvc, uhssvc and WaaSMedicSvc, and setting the NoAutoUpdate policy. Two or more distinct signals on one host are escalated to critical.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1562.001, T1490, T1489, T1112, T1059.003
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_security
• Severity: critical
• Confidence: high

Splunk SPL

```Silver Fox host weakening: Defender exclusion, shadow deletion, Windows Update tampering```
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
((CommandLine="*Add-MpPreference*" CommandLine="*ExclusionPath*")
 OR (CommandLine="*vssadmin*" CommandLine="*delete*" CommandLine="*shadows*")
 OR ((CommandLine="*wuauserv*" OR CommandLine="*UsoSvc*" OR CommandLine="*uhssvc*" OR CommandLine="*WaaSMedicSvc*") (CommandLine="*stop*" OR CommandLine="*disabled*" OR CommandLine="*Stop-Service*" OR CommandLine="*Set-Service*"))
 OR CommandLine="*NoAutoUpdate*")
| eval signal=case(match(CommandLine,"(?i)Add-MpPreference"),"T1562.001_defender_exclusion",match(CommandLine,"(?i)vssadmin"),"T1490_shadow_delete",match(CommandLine,"(?i)NoAutoUpdate"),"T1112_noautoupdate_policy",true(),"T1489_update_service_stop")
| stats count dc(signal) as distinct_signals values(signal) as signals values(CommandLine) as command_lines values(ParentImage) as parents min(_time) as first_seen max(_time) as last_seen by host, User
| eval risk=if(distinct_signals>=2,"critical","high")
| convert ctime(first_seen) ctime(last_seen)
| sort - distinct_signals

Microsoft KQL

// Silver Fox host weakening: Defender exclusions, shadow copy deletion, Windows Update tampering
DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Signal = case(
    ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "ExclusionPath", "defender_exclusion",
    ProcessCommandLine has "vssadmin" and ProcessCommandLine has "delete" and ProcessCommandLine has "shadows", "shadow_copy_delete",
    ProcessCommandLine has_any ("wuauserv", "UsoSvc", "uhssvc", "WaaSMedicSvc") and ProcessCommandLine has_any ("stop", "disabled", "Stop-Service", "Set-Service"), "update_service_disable",
    ProcessCommandLine has "NoAutoUpdate", "noautoupdate_policy",
    "")
| where Signal != ""
| summarize Signals = make_set(Signal), Commands = make_set(ProcessCommandLine, 10), Events = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, InitiatingProcessFileName
| extend SignalCount = array_length(Signals), Risk = iff(array_length(Signals) >= 2, "critical", "high")
| order by SignalCount desc, LastSeen desc

Sigma

title: Silver Fox Host Weakening via Defender Exclusion, Shadow Copy Deletion or Windows Update Disablement
id: 8b2e4d17-6a93-4c05-b1f8-2d9a7e3c5a61
status: experimental
description: Detects command lines used by the Silver Fox (Yinhu) fake-installer payloads to add Microsoft Defender path exclusions, delete volume shadow copies, stop or disable Windows Update services and set the NoAutoUpdate policy.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
    - https://thehackernews.com/2026/09/fake-software-installers-disable.html
author: Threadlinqs Team
date: 2026-09-29
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1112
    - attack.impact
    - attack.t1490
    - attack.t1489
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_defender:
        CommandLine|contains|all:
            - 'Add-MpPreference'
            - 'ExclusionPath'
    selection_vss:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    selection_policy:
        CommandLine|contains: 'NoAutoUpdate'
    selection_update_svc:
        CommandLine|contains:
            - 'wuauserv'
            - 'UsoSvc'
            - 'uhssvc'
            - 'WaaSMedicSvc'
    selection_update_action:
        CommandLine|contains:
            - 'stop'
            - 'disabled'
            - 'Stop-Service'
            - 'Set-Service'
    condition: selection_defender or selection_vss or selection_policy or (selection_update_svc and selection_update_action)
falsepositives:
    - Administrators managing Defender exclusions or update policy through scripts
    - Backup or imaging software that removes shadow copies
level: high

Known false positives:

• Administrators or GPO scripts adding sanctioned Defender exclusions
• Backup or disk-imaging software deleting shadow copies
• Patch-management tooling temporarily stopping Windows Update services

Tuning notes: Allow-list your management accounts and configuration-management parents for Add-MpPreference. Alert with highest priority when exclusions cover C:\, C:\Users, C:\ProgramData or C:\Program Files (x86), or when two signals fire on one host within minutes. Enable Tamper Protection to block the exclusion writes.

• 🔒 Silver Fox Counterfeit Download: Lookalike Vendor Site and Rotating-Name Installer ZIP Download · unlock with TL Creds
• 🔒 Silver Fox Persistence: SYSTEM Scheduled Task Relaunching Payloads From ProgramData and icacls Permission Grants · unlock with TL Creds
• 🔒 Silver Fox Post-Exploitation: Remote Thread Injection and Alibaba Cloud OSS Payload Retrieval From Writable Paths · unlock with TL Creds
• 🔒 Silver Fox WhatsApp-Lure Chain: MicrosoftUpdate Run Key, Staged Update Folder and Sideloaded active_desktop_render_x64.dll · unlock with TL Creds
• 🔒 Silver Fox PowerShell Defender Exclusion Script Blocks (Add-MpPreference -ExclusionPath) · unlock with TL Creds
• 🔒 Silver Fox C2 Domain Lookups and WhatsApp-Chain Beaconing to [indicator] / 172.86.126.195 · unlock with TL Creds
• 🔒 Silver Fox Fake-Installer Stage-One Payload Execution, msiexec -Embedding Launch and [indicator] Sideload · unlock with TL Creds
• 🔒 Silver Fox Fake-Site Campaign C2 Connections: Known IPs and Non-Standard Ports From Writable Paths · unlock with TL Creds

Indicators of compromise

As of 2026-09-29, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2773.

Sample indicators (3 of 29)

• IP address: 202.95.14[.]237
• Domain: iualef[.]net
• File hash: 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration

6 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

Microsoft Defender Experts (blog dated 2026-09-01) track an active campaign in which counterfeit software-download websites impersonate trusted vendors including Razer, Microsoft Edge, Kaspersky, Sejda PDF, NetEase Youdao, DiskGenius, Baidu Netdisk, oCam, draw.io, SteelSeries, Sogou, Calibre and MindMaster. Lookalike domains sit under .com.cn and .hl.cn. Microsoft assesses with moderate confidence that the activity is consistent with the publicly reported Silver Fox (Yinhu, 银狐) fake-software campaign and has not attributed it to a nation-state. Victims span healthcare and medical devices, manufacturing, gaming, technology, logistics, government and higher education, primarily China-based operations of multinationals and Chinese-speaking users.

The archive keeps the same file name (rotating patterns such as app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.*) but its hash changes on every download, meaning the payload is generated server-side per request. Two archives with identical names were observed arriving about 69 seconds apart with different contents. Single-hash blocking of the archive is therefore ineffective; Microsoft recommends pivoting on the stable payload hashes, drop-path patterns and post-execution behavior instead. This per-request rebuilding is what hampers researchers and signature-based detection.

Extracting the archive launches a wrapper installer (e.g. a_instapp83353001.exe, ainst8663586104.exe) that places a randomized stage-one payload in a world-writable location such as C:\Users\Public\<random>\<random>.exe or C:\Program Files (x86)\<random>\<random>.exe. An alternate route runs the payload through msiexec.exe -Embedding to hide behind Windows Installer. Payloads masquerade as legitimate software (Philips Speech Driver, Indigo Rose TrueUpdate Client) with placeholder version metadata, sideload malicious DLLs (UxEnhance64.dll in stage one, XPSPLOG.dll in later stages), and inject into legitimate user applications through remote-thread creation. Persistence is via scheduled tasks with benign-sounding names (e.g. 'Deadline Mission Target', 'Hierarchy Tools Smooth Inventory') that relaunch payloads from C:\ProgramData\ roughly every 60 seconds; icacls is used to grant Administrators/SYSTEM full control over payload files.

Before hands-on activity the payloads weaken the host: SYSTEM scheduled tasks write Microsoft Defender exclusions (Add-MpPreference -ExclusionPath for C:\ProgramData, C:\Users, C:\Program Files (x86) and C:\), 'vssadmin delete shadows /all /quiet' removes recovery copies, and wuauserv, UsoSvc, uhssvc and WaaSMedicSvc are stopped and disabled, wuaueng.dll is renamed, and the NoAutoUpdate policy is set. C2 traffic uses non-standard ports (5090, 7031, 7032, 7088-7090, 8050, 28290, 28300) to a set of IPs and six-character .net domains, and follow-on payloads are pulled from Alibaba Cloud OSS buckets. Third-party reporting of this campaign (CraftedSignal, summarizing Microsoft) names ValleyRAT (WinOS 4.0) and Gh0st RAT as payloads; the Microsoft text reviewed here did not itself name a final RAT.

A separate, distinct chain documented by Pelagos Intel (report 2026-09-27) reached a Malaysian recipient via WhatsApp: a finance-themed message carried PDF_C2841_20260911100446.zip containing an IMG with a signed launcher (PDF_C2089_20260911100446.exe, KuGou signer metadata) and an unsigned DLL (active_desktop_render_x64.dll posing as dwmapi.dll). The DLL runs an XOR routine, resolves APIs by hash, copies an 11,200-byte buffer to executable memory, stages files under %APPDATA%\Microsoft\Update\, persists through HKCU Run value 'MicrosoftUpdate', and repeatedly beacons to 134.122.155.135:443 (96+ attempts about 3 seconds apart). Pelagos ties this only at ecosystem level to Silver Fox tradecraft, not to the fake-site campaign, so the two sets of indicators should be applied separately.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1218.007 Msiexec; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File

Command and Control

T1071 Application Layer Protocol; T1571 Non-Standard Port

defense-impairment

T1112 Modify Registry; T1222.001 Windows Permissions; T1685 Disable or Modify Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Domains; T1583.006 Web Services

Remediation

Immediate actions

• Hunt for the stable payload SHA-256 hashes, C:\Users\Public\<random>\<random>.exe drops and SYSTEM scheduled tasks relaunching payloads from C:\ProgramData
• Block listed C2 IPs, ports and domains plus spoofed vendor and delivery domains at DNS and firewall
• Audit Microsoft Defender exclusions for C:\ProgramData, C:\Users, C:\Program Files (x86) and C:\ and remove unauthorized entries
• Isolate hosts showing vssadmin shadow deletion or wuauserv/UsoSvc/WaaSMedicSvc being disabled

Workarounds

• Enable Tamper Protection to block Defender exclusion and registry writes even from SYSTEM
• Download software only from verified official vendor sites
• Alert on unexpected HKCU Run entries such as 'MicrosoftUpdate' and on msiexec.exe -Embedding launching binaries from C:\Users\Public

Longer-term hardening

• Enable Attack Surface Reduction rules (prevalence/age/trusted-list executable block, obfuscated script block, copied/impersonated system tools block)
• Enable SmartScreen, Network Protection and Microsoft Defender XDR
• Correlate FileOriginUrl landing-page to delivery-host pairs to survive domain rotation
• Block ZIPs named app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.* from lookalike .com.cn/.hl.cn domains

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints where users run downloaded installers

Timeline

• 2026-07-13 Latest activity timestamps in Microsoft telemetry for the campaign: Task Scheduler execution, injection attempts and Alibaba Cloud storage connections
• 2026-09-01 Microsoft Defender Experts publish analysis of the counterfeit-installer campaign, assessing consistency with Silver Fox (Yinhu) with moderate confidence
• 2026-09-02 The Hacker News reports on the campaign, naming ValleyRAT and Gh0st RAT payloads and Windows Update/Defender tampering
• 2026-09-11 Timestamp 20260911100446 embedded in the WhatsApp lure filenames PDF_C2841_*.zip and PDF_C2089_*.exe analyzed by Pelagos Intel
• 2026-09-27 Pelagos Intel publishes 'SilverFox in the Desktop' on a WhatsApp-delivered signed-launcher plus sideloaded-DLL chain beaconing to locked-ioc-14:443
• 2026-09-29 Cyber Security News covers the fake-site campaign and the per-request archive rebuilding that defeats hash-based detection

Sources cited

• Microsoft Security Blog: Counterfeit installers, system compromise: tracking a deceptive software download campaign Microsoft · Vendor report · 2026-09-01
• Pelagos Intel: SilverFox in the Desktop research.pelagos-intel.com · Research · 2026-09-27
• CraftedSignal: Silver Fox fake installers brief feed.craftedsignal.io · Research
• The Hacker News: Fake Software Installers Disable Windows Update and Defender The Hacker News · News · 2026-09-02
• SilverFox Hackers Built Fake Software Sites That Hide Malware From Security Researchers cybersecuritynews.com · News · 2026-09-29
• TechRadar: Malware installer posing as a legitimate download service infecting brands across almost every industry techradar.com · News

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

More from Void Arachne

• AtlasRAT (Silver Fox / TA4922-linked) C2 Protocol Evolution: SFuck/BFuck Check-ins, XOR, ChaCha20 and TLS with Fake update.microsoft.com Certificate
• Silver Fox Counterfeit Installer Campaign Delivers Persistent, Self-Protecting Implant via Spoofed Vendor Download Sites
• ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading
• SilverFox APT Deploys Advanced ValleyRAT Campaign Against Japanese Manufacturer via DLL Sideloading and BYOVD
• AtlasRAT: Four-Stage In-Memory Loader Chain Delivers Commercial RAT via Fake Flash Player Installer (Silver Fox Overlap)
• SilverFox Deploys ValleyRAT (Go-Based RAT) with Kernel Rootkit AV/EDR Killer

Previous and next in malware

• OpenSUpdater Malware Hides Reflective Loader Inside Recompiled 7-Zip SFX Installers Previous report
• North Korea-Linked XCTDH/OmniStealer Campaign Uses Ethereum Transactions (HashHiding) for Covert C2 Signaling Next report