Malware Campaign Targets China-Based Organizations with Fake Software

Microsoft has warned about an ongoing malware campaign that attempts to trick users into downloading fake software from websites impersonating trusted brands. The campaign, which has been observed targeting China-based multinational organizations and Chinese-speaking users, involves malicious domains cloning real brand products such as Microsoft Edge, Kaspersky, Razer, and draw.io.

The malware, once installed on a device, disables Windows Update and changes Microsoft Defender settings to bypass security measures. The attackers then gain SYSTEM privileges and attempt to move laterally to other systems on the network to communicate with an attacker-controlled command-and-control infrastructure.

Microsoft believes this campaign can be attributed to Silver Fox, a cybercriminal group known for such attacks, although it does not provide further information about their goals. To avoid falling victim to this campaign, Microsoft recommends only downloading from trusted sources and closely monitoring networks for suspicious patterns and activities.