14 minmedium
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
A supply chain attack on the QuickFox VPN/game accelerator application trojanized versions 3.51.0 through 3.59.5 by injecting malicious JavaScript into an Electron renderer HTML file. The JavaScript downloaded an obfuscated loader from a typosquatting domain (cdns3.51quickfox.cn) that enforced execution guardrails before deploying an FDMTP implant via DLL sideloading using a legitimate Microsoft binary (csmonitor.exe). The FDMTP implant established C2 via a custom protocol on ports 20800-20816, collected host information, and supported remote plugin deployment through registry-based storage. Infrastructure remains active and shares technical overlap with the Twill Typhoon threat actor.
Sens:▲ 24h
Showing defanged values
- domaincdns3[.]51quickfox[.]cnTyposquatting domain masquerading as legitimate QuickFox CDN (swaps .com for .cn); hosts initial JavaScript loader and update.zip payload for the supply chain attack
- domainwww[.]google-apis[.]netFDMTP staging C2 domain masquerading as Google APIs; hosts implant components and registration endpoints
- domainwww[.]icloud-cdn[.]netFDMTP staging C2 domain used to register compromised endpoints and provide cluster IP addresses for subsequent FDMTP C2 communications
- domainwww[.]techcheck1[.]comFDMTP staging C2 domain hosting implant components, plugins, and registration endpoints
- domainwww[.]wangmeng66[.]topFDMTP staging C2 domain with multiple registration URL endpoints
- domainwww[.]wangmengsb[.]comFDMTP staging C2 domain with multiple registration URL endpoints
- domainwww[.]wangmeng[.]xyzFDMTP staging C2 domain with multiple registration URL endpoints (GetVips, GetPeers, GetAgents, etc.) for cluster node distribution
- domainwww[.]yahoo-cdn[.]it[.]comFDMTP staging C2 domain hosting implant components and registration endpoints; previously reported by Darktrace
- ip103[.]231[.]15[.]135IP resolved from www.wangmeng66.top
- ip104[.]21[.]89[.]96Cloudflare IP resolved from cdns3.51quickfox.cn
- ip154[.]223[.]58[.]142FDMTP cluster node associated with www.yahoo-cdn.it.com
- ip154[.]223[.]58[.]64FDMTP cluster node associated with www.yahoo-cdn.it.com
- ip154[.]223[.]75[.]206FDMTP cluster node associated with www.yahoo-cdn.it.com
- ip172[.]67[.]144[.]222Cloudflare IP resolved from www.google-apis.net
- ip172[.]67[.]157[.]196Cloudflare IP resolved from cdns3.51quickfox.cn
- ip172[.]67[.]197[.]227Cloudflare IP resolved from www.techcheck1.com
- ip172[.]67[.]210[.]148Cloudflare IP resolved from www.yahoo-cdn.it.com
- ip38[.]60[.]142[.]56FDMTP cluster node IP associated with www.icloud-cdn.net and www.yahoo-cdn.it.com staging domains; active C2 endpoint on ports 20800-20816
- ip45[.]158[.]180[.]250FDMTP cluster node associated with www.yahoo-cdn.it.com
- ip47[.]238[.]240[.]219FDMTP cluster node associated with www.wangmengsb.com and www.techcheck1.com
- ip47[.]238[.]64[.]56FDMTP cluster node IP associated with www.yahoo-cdn.it.com staging domain; active C2 endpoint
- ip47[.]239[.]4[.]179FDMTP cluster node associated with www.wangmengsb.com, www.techcheck1.com, and www.google-apis.net
- ip47[.]239[.]93[.]49FDMTP cluster node associated with www.yahoo-cdn.it.com
- ip47[.]76[.]92[.]73IP resolved from www.icloud-cdn.net
- ip47[.]88[.]21[.]252FDMTP cluster node associated with www.google-apis.net
- sha2562b6cdafdfe427a3de1a94a8a2ca1f09fc4c8f90e4f59089fd9b35b73185ed01cGeneration 1 FDMTP loader (Microsoft.ServiceHosting.Tools.dll) with embedded Client.dll payload as byte array; sideloaded by csmonitor.exe
- sha2563bd3b300f3278520819a06d0cb1f0eadbf946dbbc11352538246ff075eb427f1update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exe
- sha2565cbb64375636e83b5f17d6083633cecc02e2a5f4168cd7cca5cdee36ccca9b38Encrypted FDMTP payload (update.bin) variant decrypted by generation 2 loader
- sha2566634339b813e6105b5138de6ab67b016b8dfbf49233c29de9bab3207e8b50d24Generation 2 FDMTP loader variant (Microsoft.ServiceHosting.Tools.dll) that decrypts payload from config.bin
- sha2566932a20ac61fd3f93d7cfee414f6f46834068ac7c9ca011b054a6a10dc56b3d1update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exe
- sha2567462ce2595119c928cf516ec33148dc2a39dd9f71636a5c849c7ed93b7c5ca06update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exe
- sha256795594ad5e6f2868cc4d8ed12dabf4f3999a1477c6b250527c5ede9a98528fb9Generation 2 FDMTP loader (Microsoft.ServiceHosting.Tools.dll) obfuscated with JieJie .NET Protector; decrypts and loads FDMTP payload from update.bin
- sha256a5d36edc34fe54b2092349f877daf560a98f5fea635d1ac4a110b3518102ef96csmonitor.exe - legitimate Microsoft Windows Azure Compute and Storage Emulator binary used for DLL sideloading (not inherently malicious but indicative of compromise when found in temp paths)
- sha256d9db5cbc193ddaf4c0a265804fdef70c32451daaf2974fa9adf52ce1defac5f7update.zip containing generation 1 FDMTP loader and csmonitor.exe
- sha256dc666e9c148bbca5e21d8c9a97143575c075f53360f135e0191aed9e8278d396Encrypted FDMTP payload (update.bin) decrypted by generation 2 loader using AES-128-ECB
Detection / Hunteropenrouter
What Happened
A popular VPN and gaming accelerator application called QuickFox, used mainly by Chinese users, was secretly compromised by hackers who inserted malicious code into the application's installer. When users installed affected versions (3.51.0 to 3.59.5), the modified code downloaded additional malicious software from a fake website that looked like the real QuickFox domain. The malware checked if the computer was a likely target by looking for specific programs (like developer tools or cryptocurrency wallets) and avoiding computers running the Steam gaming platform. If the computer passed these checks, the malware installed a hidden backdoor program that allowed the attackers to remotely control the computer, install more tools, and steal information. The application vendor has fixed the issue in version 3.59.6, but anyone who installed an affected version should check their systems. Organizations with employees who use QuickFox should scan for the indicators of compromise listed in the report.
Key Takeaways
- Trojanized QuickFox application versions 3.51.0 through 3.59.5 delivered FDMTP implant via modified Electron renderer HTML file with two added lines of JavaScript
- Attack used typosquatting domain cdns3.51quickfox.cn (swapping .com TLD for .cn) to serve heavily obfuscated JavaScript loader with ten layers of base91 decryption
- Two generations of .NET loader observed: Gen 1 with embedded FDMTP payload as byte array, Gen 2 with AES-128-ECB encrypted payload in update.bin using hardcoded key
- Execution guardrails exit if steam.exe is running and require at least one of 26 target applications (developer tools, crypto wallets, translation apps, admin tools) to be present
- Technical crossover with Twill Typhoon campaign reported by Darktrace, including shared C2 cluster infrastructure and identical DLL sideloading TTPs
Affected Systems
- Windows endpoints running QuickFox application versions 3.51.0 through 3.59.5
- QuickFox Electron application (Windows only; MacOS builds contained trojanized HTML but guardrails prevented execution)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Trojanized QuickFox installer (v3.51.0-3.59.5) contains modified Electron HTML file with two added JavaScript lines that download loader from cdns3.51quickfox.cn
- Execution: Obfuscated JavaScript loader (firebase-app-compat.js) executes in Electron child process context with ten layers of base91 decryption
- Defense Evasion: Loader runs tasklist via cmd.exe to check for steam.exe (exit if found) and requires at least one of 26 target applications to be running
- Persistence: Downloads update.zip, extracts to %APPDATA%\Local\Temp\quickfox\updated, creates data.dat file-based mutex, and executes csmonitor.exe which sideloads malicious Microsoft.ServiceHosting.Tools.dll
- C2: FDMTP implant (Client.dll) contacts staging domain via HTTP GET /GetCluster to retrieve cluster IPs, then establishes FDMTP socket connection on ports 20800-20816
- Discovery & Plugin Deployment: C2 sends GetInfo and EnumProcessByJson RPC requests; plugins are pushed from C2, stored in registry under HKCU\SOFTWARE\Microsoft\IME{HWID}, and executed on demand
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: FortiGuard AntiVirus signatures, FortiGuard Web Filtering, FortiGuard IP Reputation and Anti-Botnet Security Service
FortiGuard AV signatures are available for identified malicious files (e.g., MSIL/Agent.BB52!tr, MSIL/Agent.7856!tr, Data/Agent.D7BF!tr, Zip/Agent.DDD7!tr). FortiGate, FortiMail, FortiClient, and FortiEDR can ingest these signatures. Malicious URLs are rated by FortiGuard Web Filtering, and cluster IPs are blocked by FortiGuard IP Reputation service. No custom YARA, Sigma, Snort, or SIEM queries are provided in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The attack involves observable process behaviors (QuickFox.exe spawning many cmd.exe children, csmonitor.exe executing from temp directories, DLL sideloading), but the Electron application's inherent process spawning behavior creates significant noise that may mask malicious activity. The file-based mutex and registry plugin storage are detectable if EDR monitors file creation and registry writes in user space. |
| Network Visibility | Medium | Initial C2 uses HTTP to typosquatting and staging domains, which is detectable via DNS and proxy logs. However, FDMTP C2 on ports 20800-20816 uses a custom protocol that may not be flagged by standard network signatures. Staging domains use Cloudflare CDN, complicating IP-based blocking. |
| Detection Difficulty | Moderate | The attack uses legitimate binaries for sideloading and masquerading domains that mimic legitimate infrastructure, requiring behavioral analysis rather than simple signature matching. However, the process lineage anomalies (QuickFox spawning cmd.exe for tasklist, csmonitor.exe in temp paths) and known C2 domains provide viable detection paths. The Electron process noise is a challenge but also a distinguishing behavioral pattern. |
Required Log Sources
- Process creation events (Sysmon Event ID 1 or EDR equivalent)
- DNS resolution logs
- HTTP proxy logs with URL and User-Agent fields
- Registry modification events (Sysmon Event ID 12, 13, 14)
- File creation events in temp directories
- Network connection events with destination port information
- Image load events for DLL sideloading detection (Sysmon Event ID 7)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for instances where QuickFox.exe or its Electron child processes spawn cmd.exe processes that execute tasklist commands, as this indicates the guardrail validation phase of the FDMTP infection chain. | Process creation events with parent-child relationship data and command line arguments | Execution / Defense Evasion | Medium - Electron applications may legitimately spawn child processes, but tasklist execution from this specific parent is anomalous |
| Consider hunting for csmonitor.exe (Windows Azure Compute and Storage Emulator) executing from non-standard paths such as %APPDATA%\Local\Temp, as its presence in temp directories indicates DLL sideloading for FDMTP payload delivery. | Process creation events with full executable paths and image load events for DLLs loaded by csmonitor.exe | Persistence / Defense Evasion | Low - csmonitor.exe is a development tool rarely found in temp directories in normal operations |
| Consider hunting for network connections to domains masquerading as legitimate CDN or API services (e.g., icloud-cdn.net, google-apis.net, yahoo-cdn.it.com, techcheck1.com, wangmeng.xyz) that use HTTP GET requests with paths like /GetCluster, /GetSlaver, /GetNodes, or similar endpoint enumeration patterns. | DNS logs, HTTP proxy logs with full URLs, and network flow data | Command and Control | Low - these domain names do not correspond to legitimate services and the URL patterns are distinctive |
| Consider hunting for custom protocol traffic on ports 20800-20816 that does not match known application protocols, as FDMTP C2 communications use a proprietary handshake with specific flag packets (00 01, 00 04, 00 14, 00 15). | Network flow data with port information, full packet capture or NDR solutions with protocol analysis | Command and Control | Low - the specific port range and custom protocol pattern are distinctive to FDMTP |
| Consider hunting for registry modifications under HKCU\SOFTWARE\Microsoft\IME\ with sub-key names matching hardware ID patterns, as the FDMTP implant stores compressed plugin DLLs in this location for persistence. | Registry modification events (Sysmon Event ID 12, 13) or EDR registry monitoring | Persistence / Defense Evasion | Low - legitimate IME registry keys typically do not use hardware ID-based sub-key names or store binary data |
Control Gaps
- Signature-based AV may not detect obfuscated JavaScript loaders using custom base91 encryption with ten layers
- Network controls may not flag FDMTP protocol traffic on non-standard ports 20800-20816 without custom protocol signatures
- Cloudflare CDN usage by staging domains complicates IP-based blocking and may bypass simple domain filtering
- DLL sideloading using legitimate Microsoft binaries may bypass application whitelisting if the legitimate binary is allowed
- Electron application process noise may overwhelm behavioral detection rules that rely on process spawning thresholds
Key Behavioral Indicators
- QuickFox.exe spawning cmd.exe child processes that execute tasklist commands
- csmonitor.exe executing from %APPDATA%\Local\Temp\quickfox\updated\ directory
- Microsoft.ServiceHosting.Tools.dll loaded by csmonitor.exe from a non-standard temp path
- Network connections from QuickFox.exe to cdns3.51quickfox.cn domain
- HTTP GET requests to staging domains with paths matching /GetCluster, /GetSlaver, /GetNodes, /GetEndpoints patterns
- FDMTP protocol traffic on ports 20800-20816 with specific flag packet headers
- Registry writes under HKCU\SOFTWARE\Microsoft\IME\ with hardware ID-based sub-key names
- data.dat file creation in %APPDATA%\Local\Temp\quickfox\updated\ as file-based mutex
- Multiple cmd.exe processes spawned from single QuickFox Electron child process in rapid succession
False Positive Assessment
Medium - The QuickFox Electron application inherently spawns many child processes, which creates noise that may generate false positives in behavioral detection rules. However, specific indicators like csmonitor.exe in temp paths, connections to masquerading domains, and FDMTP protocol traffic on ports 20800-20816 have low false positive rates. The tasklist execution from QuickFox child processes is the most likely source of false positives if QuickFox is used legitimately in the environment.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider identifying any endpoints running QuickFox application versions 3.51.0 through 3.59.5 and isolating them for forensic analysis.
- Consider blocking the identified C2 domains and FDMTP cluster IPs at your firewall, proxy, and DNS filtering layers if supported by your infrastructure.
- If your EDR supports host isolation, consider isolating any endpoints showing signs of compromise (csmonitor.exe in temp paths, connections to staging domains) pending investigation.
- Consider searching endpoint logs for the presence of Microsoft.ServiceHosting.Tools.dll, update.bin, or config.bin in %APPDATA%\Local\Temp\quickfox\updated\ directories.
Infrastructure Hardening
- Evaluate whether your web filtering solution can block the identified staging domains (icloud-cdn.net, google-apis.net, yahoo-cdn.it.com, techcheck1.com, wangmeng.xyz, wangmengsb.com, wangmeng66.top) and the typosquatting domain cdns3.51quickfox.cn.
- Consider implementing network-level detection for custom protocol traffic on ports 20800-20816 if your NDR or IDS supports custom protocol signatures.
- If applicable, consider restricting outbound network connections from application temp directories to prevent C2 communications from sideloaded payloads.
User Protection
- Consider notifying users who may have installed QuickFox application versions 3.51.0 through 3.59.5 to update to version 3.59.6 or later immediately.
- If your EDR supports application control, consider evaluating whether csmonitor.exe should be permitted to execute from temp directories in your environment.
- Consider deploying registry monitoring for modifications under HKCU\SOFTWARE\Microsoft\IME\ with unusual sub-key patterns, if supported by your endpoint tooling.
Security Awareness
- Consider incorporating supply chain attack awareness into existing security training programs, emphasizing the risk of installing software from vendors without transparent version histories or publicly accessible release timelines.
- If applicable to your workforce, consider communicating to employees who use Chinese-language applications or VPN accelerators that they should verify they are running the latest patched versions.
- Consider reminding users to report any unexpected application behavior, such as applications spawning command windows or unusual network activity.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping12 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Lateral Movement
Tactic
Command and Control
Additional IOCs
- Ips:
47[.]239[.]93[.]49- FDMTP cluster node associated with www.yahoo-cdn.it.com47[.]239[.]4[.]179- FDMTP cluster node associated with www.wangmengsb.com, www.techcheck1.com, and www.google-apis.net47[.]88[.]21[.]252- FDMTP cluster node associated with www.google-apis.net47[.]238[.]240[.]219- FDMTP cluster node associated with www.wangmengsb.com and www.techcheck1.com154[.]223[.]75[.]206- FDMTP cluster node associated with www.yahoo-cdn.it.com154[.]223[.]58[.]64- FDMTP cluster node associated with www.yahoo-cdn.it.com45[.]158[.]180[.]250- FDMTP cluster node associated with www.yahoo-cdn.it.com154[.]223[.]58[.]142- FDMTP cluster node associated with www.yahoo-cdn.it.com172[.]67[.]157[.]196- Cloudflare IP resolved from cdns3.51quickfox.cn104[.]21[.]89[.]96- Cloudflare IP resolved from cdns3.51quickfox.cn47[.]76[.]92[.]73- IP resolved from www.icloud-cdn.net172[.]67[.]144[.]222- Cloudflare IP resolved from www.google-apis.net172[.]67[.]197[.]227- Cloudflare IP resolved from www.techcheck1.com172[.]67[.]210[.]148- Cloudflare IP resolved from www.yahoo-cdn.it.com103[.]231[.]15[.]135- IP resolved from www.wangmeng66.top
- Domains:
www[.]google-apis[.]net- FDMTP staging C2 domain masquerading as Google APIs; hosts implant components and registration endpointswww[.]wangmengsb[.]com- FDMTP staging C2 domain with multiple registration URL endpointswww[.]wangmeng66[.]top- FDMTP staging C2 domain with multiple registration URL endpoints
- Urls:
cdns3.51quickfox.cn/script/firebase-app-compat.js- URL for downloading obfuscated JavaScript loader masquerading as Firebase SDK; embedded in trojanized index.htmlcdns3.51quickfox.cn/script/firebase-analytics-compat.js- URL for downloading legitimate Google Firebase script used as decoy to hide supply chain attackwww.icloud-cdn.net://8080/GetCluster- Registration URL on staging domain for FDMTP implant to retrieve cluster node IPswww.icloud-cdn.net/checksum.bin- URL to retrieve FDMTP implant component from staging domainwww.icloud-cdn.net/dnscfg.dll- URL to retrieve FDMTP implant component from staging domainwww.icloud-cdn.net/Client.dll- URL to retrieve FDMTP implant payload from staging domainwww.yahoo-cdn.it.com/dfsvc.exe.config- URL to retrieve FDMTP implant configuration from staging domainwww.yahoo-cdn.it.com/dnscfg.dll- URL to retrieve FDMTP implant component from staging domainwww.google-apis.net/dfsvc.exe- URL to retrieve legitimate binary likely used as sideloading target for FDMTP implantwww.google-apis.net/wangmeng.dll- URL to retrieve updated FDMTP implant from staging domainwww.techcheck1.com/wangmeng.dll- URL to retrieve updated FDMTP implant from staging domainwww.techcheck1.com/config.etl- URL to retrieve encrypted FDMTP payload from staging domain
- File Hashes:
6634339B813E6105B5138DE6AB67B016B8DFBF49233C29DE9BAB3207E8B50D24(SHA256) - Generation 2 FDMTP loader variant (Microsoft.ServiceHosting.Tools.dll) that decrypts payload from config.binDC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396(SHA256) - Encrypted FDMTP payload (update.bin) decrypted by generation 2 loader using AES-128-ECB5CBB64375636E83B5F17D6083633CECC02E2A5F4168CD7CCA5CDEE36CCCA9B38(SHA256) - Encrypted FDMTP payload (update.bin) variant decrypted by generation 2 loaderA53D756F28457B1C4A239C91CDEC8ED7B7DA67A93E33E2E6DF9621CBEF8417474(SHA256) - Encrypted FDMTP payload (config.bin) variant decrypted by generation 2 loaderD9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7(SHA256) - update.zip containing generation 1 FDMTP loader and csmonitor.exe7462CE2595119C928CF516EC33148DC2A39DD9F71636A5C849C7ED93B7C5CA06(SHA256) - update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exe3BD3B300F3278520819A06D0CB1F0EADBF946DBBC11352538246FF075EB427F1(SHA256) - update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exe6932A20AC61FD3F93D7CFEE414F6F46834068AC7C9CA011B054A6A10DC56B3D1(SHA256) - update.zip containing generation 2 FDMTP loader, payload, and csmonitor.exeA5D36EDC34FE54B2092349F877DAF560A98F5FEA635D1AC4A110B3518102EF96(SHA256) - csmonitor.exe - legitimate Microsoft Windows Azure Compute and Storage Emulator binary used for DLL sideloading (not inherently malicious but indicative of compromise when found in temp paths)
- Registry Keys:
HKCU\SOFTWARE\Microsoft\IME\{Common.HostInfo.HWID}- Registry sub-key used by FDMTP implant to store compressed plugin DLLs received from C2 server; each value/data pair represents a different executed plugin module
- File Paths:
%APPDATA%\Local\Temp\quickfox\updated\- Directory where update.zip contents are extracted including csmonitor.exe, Microsoft.ServiceHosting.Tools.dll, and update.bin%TEMP%\quickfox\update.zip- Location where downloaded update.zip is saved prior to extraction%LocalAppData%\Microsoft\WindowsApps- Directory where FDMTP plugin (Assist.dll) downloads additional executable files from C2
- Command Lines:
- Purpose: Process enumeration for execution guardrails - checks for steam.exe and target applications | Tools:
cmd.exe,tasklist.exe| Stage: Initial execution / guardrail validation |tasklist /NH /FO CSV - Purpose: Service state query as part of environment discovery | Tools:
cmd.exe,sc.exe| Stage: Guardrail validation / environment discovery |sc query <service> - Purpose: Filtering service state output | Tools:
cmd.exe,findstr.exe| Stage: Guardrail validation / environment discovery |findstr "STATE" - Purpose: Checking if specific services are running | Tools:
cmd.exe,net.exe| Stage: Guardrail validation / environment discovery |net start <service>
- Purpose: Process enumeration for execution guardrails - checks for steam.exe and target applications | Tools: