FortiGuard Labs tracked a supply chain attack against QuickFox that trojanized a Windows Electron installer, used a fake `cdns3[.]51quickfox[.]cn` domain, and delivered a JavaScript loader that deployed the FDMTP implant for persistent access. The campaign has been active since at least August 2025, shows ongoing infrastructure development, and uses guardrails plus DLL sideloading to target specific Windows endpoints while avoiding re-infection. #QuickFox #FDMTP #TwillTyphoon
Keypoints
- FortiGuard Labs identified a long-running supply chain compromise of the QuickFox Windows application.
- The installer was modified by adding JavaScript to an Electron-rendered HTML file, which then downloaded and executed the first-stage loader.
- A typosquatted domain, `cdns3[.]51quickfox[.]cn`, was used to host the malicious loader and related files.
- The initial loader checked for Windows, prevented re-infection, and used process-based guardrails to decide whether to continue.
- If conditions were met, the campaign downloaded `update.zip`, extracted components, and used `csmonitor.exe` to sideload `Microsoft.ServiceHosting.Tools.dll`.
- Two generations of the FDMTP loader were observed, both leading to deployment of the `Client.dll` implant and staged C2 communication.
- QuickFox removed the malicious components from Windows installer v3.59.6 after Fortinet disclosure, and FortiGuard did not confidently attribute the campaign to a specific actor, though it overlaps technically with Twill Typhoon reporting.
MITRE Techniques
- [T1195.002 ] Supply Chain Compromise: Compromise Software Supply Chain – The QuickFox installer was trojanized before delivery to users, embedding malicious JavaScript in the bundled Electron HTML file (‘the supply chain attack involves a trojanized version of the QuickFox application’).
- [T1059.007 ] Command and Scripting Interpreter: JavaScript – Obfuscated JavaScript was executed inside the Electron app to fingerprint the endpoint and download later payloads (‘download and execute a JavaScript-based loader’).
- [T1112 ] Modify Registry – The implant stored encrypted plugin modules in the registry for later execution (‘save the compressed executable file into the system registry under the specific sub-key’).
- [T1574.001 ] Hijack Execution Flow: DLL – `csmonitor.exe` was used to sideload a malicious DLL (‘used to sideload `Microsoft.ServiceHosting.Tools.dll`’).
- [T1480 ] Execution Guardrails – The loader checked for `steam.exe` and other processes before proceeding (‘If Steam is running or none of the listed applications are running, the infection process will end’).
- [T1036.005 ] Masquerading: Match Legitimate Resource Name or Location – Malicious infrastructure and files masqueraded as legitimate QuickFox/Firebase resources (‘attempt to masquerade as legitimate QuickFox infrastructure’).
- [T1057 ] Process Discovery – The loader used `tasklist` to enumerate running processes and decide whether to continue (‘generate a list of processes using the tasklist command’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – Initial C2 communication and payload retrieval used HTTP/HTTPS web requests (‘C2 communications are initially through web requests to malicious domains’).
- [T1104 ] Multi-Stage Channels – The initial web-based loader stage transitioned into FDMTP-based cluster communication (‘the FDMTP implant communicates via TouchSocket Duplex Message Transport Protocol’).
Indicators of Compromise
- [Domain ] Malicious QuickFox masquerading infrastructure and staging – `cdns3[.]51quickfox[.]cn`, `www[.]icloud-cdn[.]net`
- [URL ] Initial loader and second-stage payload retrieval – `cdns3[.]51quickfox[.]cn/script/firebase-app-compat.js`, `cdns3[.]51quickfox[.]cn/2025090411/update.zip`
- [URL ] FDMTP staging and registration endpoints – `www[.]icloud-cdn[.]net/GetCluster`, `www[.]yahoo-cdn[.]it[.]com/GetCluster?protocol=Dotnet-TcpDmtp&tag=&uid=`
- [Domain ] Additional FDMTP staging domains – `www[.]google-apis[.]net`, `www[.]techcheck1[.]com`
- [Domain ] Additional FDMTP infrastructure domains – `www[.]wangmeng[.]xyz`, `www[.]wangmengsb[.]com`
- [IP Address ] Resolved infrastructure and cluster nodes – `172[.]67[.]157[.]196`, `47[.]238[.]64[.]56`
- [IP Address ] Additional cluster examples – `154[.]223[.]58[.]64`, `45[.]158[.]180[.]250`
- [File Name ] Payload and loader files – `update.zip`, `Microsoft.ServiceHosting.Tools.dll`
- [File Name ] Encrypted or embedded FDMTP payload components – `update.bin`, `config.bin`, `Client.dll`
- [File Name ] Sideloading host binary – `csmonitor.exe`
- [File Hash ] FDMTP loader samples – `2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C`, `795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9`
- [File Hash ] Encrypted payload and archive samples – `DC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396`, `D9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7`