#ParsedReport #CompletenessHigh
01-09-2026

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/

Report completeness: High

Actors/Campaigns:
Silver_fox

Threats:
Typosquatting_technique
Process_injection_technique
Shadow_copies_delete_technique
Vssadmin_tool

Victims:
Healthcare, Medical devices, Manufacturing, Gaming, Technology, Logistics, Government, Higher education

Industry:
Logistic, Government, Healthcare, Education, Entertainment

Geo:
China

TTPs:
Tactics: 7
Technics: 19

IOCs:
Domain: 28
File: 22
Url: 7
Path: 12
Command: 7
Registry: 2
IP: 14
Coin: 1
Hash: 7

Soft:
Microsoft Defender, Alibaba Cloud, Microsoft Edge, Youdao, Sogou, WinRAR, RAR.exe, Task Scheduler, Windows Installer, ask Scheduler se, have more...

Algorithms:
exhibit, zip, sha256

Functions:
CreateRemoteThreadApiCall, Get-ScheduledTask

Win Services:
wuauserv, UsoSvc, WaaSMedicSvc, uauserv, U, soSvc, W, aaSMedicSvc an

Languages:
powershell

Platforms:
x86