/
← Voltar ao feed
high education general consumers

QuickFox supply chain compromise trojanizes Windows app to deploy FDMTP implant, with technical overlap to Twill Typhoon

1 fonte(s) · 1 atualização(ões) · publicado 04/08/2026 10:00 · coletado há 1 dia

FortiGuard Incident Response reports a supply chain attack on the QuickFox Windows application, whose trojanized components deployed the FDMTP implant to users. QuickFox's user base is mainly Chinese international students and expats. Affected Windows versions are those later than v3.0.35 and earlier than v3.55.6. QuickFox has removed the malicious components and opened an internal investigation. FortiGuard does not confidently attribute the campaign, but notes strong technical crossover with a campaign reported by Darktrace and externally attributed to Twill Typhoon. Initial infection appears opportunistic, with collected data centralized, likely for second-stage target validation.

Technical Details

  • Trojanized HTML code runs JavaScript that makes the initial C2 connection. It aborts if steam.exe is running, likely to avoid personal-use endpoints. It installs the payload only if certain processes are present, such as admin tooling, Chinese translation apps, developer tools and crypto-related apps.
  • The final payload is FDMTP, loaded via DLL side-loading (T1574.001). In this case csmonitor.exe was the side-load target. The earlier Darktrace-reported campaign abused biz_render.exe (Sogou Pinyin IME) with browser_host.dll.
  • The Assist.dll plugin downloads two files to %LocalAppData%\Microsoft\WindowsApps, and the C2 can then execute them via a StartProcess RPC request. The download URLs are embedded in the server-provided plugin and are configurable per campaign.
  • Attribution links are technical only: shared loader code structure and overlapping C2 cluster IPs from staging domains were seen in both campaigns, indicating with high confidence the same infrastructure and tooling.
  • FortiGuard saw little post-exploitation beyond basic enumeration, and no plugins beyond those in Darktrace's earlier FDMTP reporting.
  • Two targeting hypotheses are offered: Chinese citizens abroad, or professionals dealing with Chinese speakers for trade or diplomacy. Neither can be confirmed without second-stage victim context.

Remediation

  • Update QuickFox to a version at or after v3.55.6, where the malicious components were removed, and treat hosts running affected versions as potentially compromised.
  • FortiGuard AntiVirus signatures cover the IOCs (FortiGate, FortiMail, FortiClient, FortiEDR). The URLs are rated malicious by FortiGuard Web Filtering, and IP Reputation and Anti-Botnet services block the associated infrastructure.
  • Prepare for supply chain attacks aimed at niche user bases outside the usual threat profile, and apply timely open-source intelligence for detection.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 04/08/2026 10:00 · coletado 19/10 18:02 primeiro registro

    QuickFox supply chain compromise trojanizes Windows app to deploy FDMTP implant, with technical overlap to Twill Typhoon

    ler a análise desta fonte

    FortiGuard Incident Response reports a supply chain attack on the QuickFox Windows application, whose trojanized components deployed the FDMTP implant to users. QuickFox's user base is mainly Chinese international students and expats. Affected Windows versions are those later than v3.0.35 and earlier than v3.55.6. QuickFox has removed the malicious components and opened an internal investigation. FortiGuard does not confidently attribute the campaign, but notes strong technical crossover with a campaign reported by Darktrace and externally attributed to Twill Typhoon. Initial infection appears opportunistic, with collected data centralized, likely for second-stage target validation.

    Technical Details

    • Trojanized HTML code runs JavaScript that makes the initial C2 connection. It aborts if steam.exe is running, likely to avoid personal-use endpoints. It installs the payload only if certain processes are present, such as admin tooling, Chinese translation apps, developer tools and crypto-related apps.
    • The final payload is FDMTP, loaded via DLL side-loading (T1574.001). In this case csmonitor.exe was the side-load target. The earlier Darktrace-reported campaign abused biz_render.exe (Sogou Pinyin IME) with browser_host.dll.
    • The Assist.dll plugin downloads two files to %LocalAppData%\Microsoft\WindowsApps, and the C2 can then execute them via a StartProcess RPC request. The download URLs are embedded in the server-provided plugin and are configurable per campaign.
    • Attribution links are technical only: shared loader code structure and overlapping C2 cluster IPs from staging domains were seen in both campaigns, indicating with high confidence the same infrastructure and tooling.
    • FortiGuard saw little post-exploitation beyond basic enumeration, and no plugins beyond those in Darktrace's earlier FDMTP reporting.
    • Two targeting hypotheses are offered: Chinese citizens abroad, or professionals dealing with Chinese speakers for trade or diplomacy. Neither can be confirmed without second-stage victim context.

    Remediation

    • Update QuickFox to a version at or after v3.55.6, where the malicious components were removed, and treat hosts running affected versions as potentially compromised.
    • FortiGuard AntiVirus signatures cover the IOCs (FortiGate, FortiMail, FortiClient, FortiEDR). The URLs are rated malicious by FortiGuard Web Filtering, and IP Reputation and Anti-Botnet services block the associated infrastructure.
    • Prepare for supply chain attacks aimed at niche user bases outside the usual threat profile, and apply timely open-source intelligence for detection.