Chinese hackers spoof Razer, Kaspersky and Microsoft download sites

Full text

Microsoft warns Chinese group Silver Fox spoofed download sites for major tech brands

Victims install backdoored software enabling persistence, disabling Defender/updates, and payload delivery

Targets span healthcare, manufacturing, gaming, government; Microsoft urges tamper protection and behavior‑based detection

Cybercriminals are spoofing some of the world’s most popular technology and software companies in an attempt to infect their targets with dangerous backdoors . This is according to security researchers from Microsoft, who warned about the ongoing campaign in an in-depth report published earlier this week.

Microsoft said it discovered an ongoing campaign in which Chinese hackers (presumably Silver Fox, AKA Yinhu) were creating fraudulent download pages for some of the world’s most popular tech and software companies, including Razer, Kaspersky, Microsoft, NetEase, Baidu NetDisk, oCam ScreenRecorder, SteelSeries, Calibre, MindMaster, and many others.

Victim organizations looking to download software built by these companies end up downloading a weaponized version that works primarily as a backdoor. This implant allows the attackers a foothold from which they can maintain access and send/receive messages.

How to defend against Silver Fox

Once installed, the backdoor creates scheduled tasks for persistence, injects itself into legitimate processes, and weakens Microsoft Defender and Windows Update by creating a large exclusion folder and disabling a number of update-related services.

It also deletes backups, and allows the attackers to deploy further payloads.

Victims are primarily Chinese organizations, although the attackers do seem to be casting a rather wide net, Microsoft suggests. The majority of victims were found in medical devices and healthcare, manufacturing, gaming, technology, logistics, government, and higher education.

Microsoft says its Defender product “detected and disrupted” the activity across multiple stages of the attack, “including automated containment through attack disruption.”

Still, to defend against Silver Fox’s latest shenanigans, Microsoft advises organizations enforce tamper Protection which blocks exclusion and registry writes to Microsoft Defender even when the payload runs as SYSTEM.

It also suggests defenders hunt for “behavior, not file names”, set up alerts for tamper sequences, and treat look-alike download archives as malicious in web and mail flow. The full list of Indicators of Compromise (IoC) can be found on this link , as well.