Fake Software Installers Disable Windows Update and Weaken Microsoft Defender

Summary

A malware campaign uses fake software sites to distribute installers that disable Windows Update and weaken Microsoft Defender. The campaign, potentially linked to the Silver Fox cluster, targets multinational organizations and Chinese-speaking users across various sectors. The malware establishes persistence, disables security features, and communicates with command-and-control servers.

Key Takeaways

1. An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.
2. The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users.
3. The malware is also responsible for creating a short-lived scheduled task that runs as SYSTEM and configures Microsoft Defender exclusions via PowerShell, deletes volume shadow copies, and ensures payload directories cannot be removed by standard users by modifying their discretionary access control lists (DACLs) using icacls.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 25% of statements classified as editorial or subjective
• Claims: 15% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on information from Microsoft and Kaspersky, reputable cybersecurity firms. It provides specific technical details about the malware's operation and infrastructure. However, some claims are attributed to 'moderate confidence' or are unclear, indicating a need for reader caution.

Bias assessment: Technical Security Reporting. The article focuses on technical details of a cybersecurity threat, reporting on malware capabilities and attribution. While it mentions the origin of the threat, the primary lens is on the technical aspects of the attack and defense, not political or social commentary.

Note: This article provides a technical analysis of a malware campaign. While based on reports from cybersecurity experts, readers should be aware that some attributions are made with moderate confidence.

Credibility flag: Technical Analysis

Claimed Facts (8)

• This statement describes the direct actions and capabilities of the deployed malware.
• This lists the industries affected by the malware campaign.
• This attributes the campaign to a specific threat cluster with supporting evidence of past activities.
• This provides specific technical details about the infrastructure and lure used in the campaign.
• This describes the deceptive nature of the counterfeit websites.
• This details a specific technical characteristic of the downloaded payload.
• This lists specific actions taken by the malware to disrupt Windows Update functionality.
• This provides technical details about the malware's communication channels.

Opinions (6)

• This is a characterization of the original software's behavior, presented as an expert opinion.
• This explains the malicious use of the software, framing it as an attacker's technique.
• This is an assessment of the attackers' strategy and its impact on detection.
• This provides an interpretation of the threat actor's motivations and targets.
• This is a statement about the general usage of the malware, not tied to a specific instance.
• This is an expert opinion on the challenges of malware attribution.

Claims (8)

• This statement expresses uncertainty about the ultimate objective, which could be speculative.
• While factually reporting on another disclosure, the phrasing 'merely days after' could be seen as a narrative framing device.
• While likely true, the phrasing 'besides taking steps to protect its process' is a general statement about malware behavior that could be elaborated.
• This describes a potential behavior that, without further context, could be interpreted broadly.
• The term 'sophisticated implant' is subjective and the list of features, while likely accurate, is presented without specific evidence within this snippet.
• The phrase 'at some point' introduces vagueness into the attribution.
• While attributed to a company, the specific mechanism of 'abusing code-signing certificates' is a technical claim that requires substantiation.
• This is a report from state media, which can sometimes be subject to government influence or agenda.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• Microsoft — Technology Company
• Kaspersky — Cybersecurity Company
• Aaron Walton — Security Researcher
• China Daily — State Media Outlet