---
title: QuickFox Trojanized Installer - Electron JavaScript Loader Execution
id: 7a3f1c2e-9d4b-4e8a-b1f5-3c6d2e8a9f01
status: experimental
description: Detects execution of QuickFox Electron application with modified renderer HTML/JavaScript loader associated with the FDMTP supply chain implant (Twill Typhoon)
author: Security Arsenal Threat Intelligence
references:
  - https://www.fortinet.com/blog/threat-research/quickfox-supply-chain-attack-used-to-deploy-fdmtp-implant
date: 2026/09/05
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\quickfox.exe'
      - '\QuickFox.exe'
  selection_child:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate QuickFox update activity (rare - Electron apps seldom spawn script interpreters)
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1574.002
---
title: DLL Sideloading from QuickFox Application Directory
id: 8b4e2d3f-0e5c-5f9b-c2a6-4d7e3f9b0a12
status: experimental
description: Detects DLL loading from QuickFox installation paths by non-QuickFox signed processes, consistent with FDMTP implant sideloading behavior
author: Security Arsenal Threat Intelligence
references:
  - https://www.fortinet.com/blog/threat-research/quickfox-supply-chain-attack-used-to-deploy-fdmtp-implant
date: 2026/09/05
logsource:
  category: image_load
  product: windows
detection:
  selection_path:
    ImageLoaded|contains:
      - '\QuickFox\'
      - '\quickfox\'
  selection_temp:
    ImageLoaded|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\QuickFox\'
  filter_signed:
    Signed: 'true'
    SignatureStatus: 'valid'
  condition: (selection_path or selection_temp) and not filter_signed
falsepositives:
  - Legitimate unsigned vendor plugins
level: high
tags:
  - attack.persistence
  - attack.t1574.002
  - attack.t1574.001
---
title: QuickFox FDMTP C2 and Staging Domain Resolution
id: 9c5f3e4a-1f6d-6a0c-d3b7-5e8f4a0c1b23
status: experimental
description: Detects DNS resolution of known FDMTP implant staging and C2 domains including lookalike CDN infrastructure
author: Security Arsenal Threat Intelligence
date: 2026/09/05
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'jiejie.net'
      - 'icloud-cdn.net'
      - 'cdns3.51quickfox.cn'
  condition: selection
falsepositives:
  - None expected - these are confirmed malicious/typosquat domains
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1583.001

// QuickFox FDMTP + ENDLESSDOORS supply chain hunt - Microsoft Sentinel
// Hunts for C2 domain contact, QuickFox process anomalies, and suspicious outbound from network edge devices
let lookback = 30d;
let malicious_domains = dynamic(["jiejie.net", "www.icloud-cdn.net", "cdns3.51quickfox.cn"]);
// Part 1: DNS/network connections to FDMTP C2 infrastructure
let dns_hits = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (malicious_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend Hunt = "FDMTP C2 Contact";
// Part 2: QuickFox spawning unexpected child processes (Electron JS loader behavior)
let proc_hits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName =~ "quickfox.exe"
| where FileName in~ ("rundll32.exe", "regsvr32.exe", "powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| extend Hunt = "QuickFox Suspicious Child Process";
// Part 3: Endpoints running trojanized QuickFox installer versions (3.0.51.0 - 3.59.5)
let version_hits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName =~ "quickfox.exe" or ProcessCommandLine has "QuickFox"
| where FileVersion startswith "3."
| project TimeGenerated, DeviceName, FileName, FileVersion, FolderPath, SHA256
| extend Hunt = "Potentially Trojanized QuickFox Version";
union dns_hits, proc_hits, version_hits
| sort by TimeGenerated desc

<#
.SYNOPSIS
  Security Arsenal - Supply Chain Compromise Hunt Script
  Hunts for QuickFox FDMTP implant artifacts and Zbtlink/ENDLESSDOORS exposure indicators
.DESCRIPTION
  Run on endpoints (QuickFox hunt) and use the network section from any management host
  to enumerate potentially backdoored routers (CVE-2026-66747).
#>

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[*] Security Arsenal Supply Chain Hunt - $(Get-Date)`n" -ForegroundColor Cyan

# --- 1. QuickFox installation and version check ---
Write-Host "[1] Checking for QuickFox installations..." -ForegroundColor Yellow
$quickfoxPaths = @("$env:LOCALAPPDATA\Programs\QuickFox", "$env:ProgramFiles\QuickFox", "${env:ProgramFiles(x86)}\QuickFox", "$env:APPDATA\QuickFox")
foreach ($path in $quickfoxPaths) {
    if (Test-Path $path) {
        $exe = Get-ChildItem -Path $path -Filter "quickfox.exe" -Recurse | Select-Object -First 1
        if ($exe) {
            $ver = $exe.VersionInfo.FileVersion
            $flagged = $false
            # Trojanized range: 3.0.51.0 - 3.59.5
            if ($ver -match '^3\.' ) {
                $parts = $ver -split '\.'
                if ([int]$parts[1] -lt 59 -or ($ver -match '^3\.0\.' -and [int]$parts[2] -ge 51)) { $flagged = $true }
            }
            $report += [PSCustomObject]@{ Check="QuickFox Install"; Path=$exe.FullName; Version=$ver; Risk=$(if($flagged){"HIGH - Trojanized version range"}else{"Review manually"}) }
        }
    }
}

# --- 2. Hash sweep for known trojanized installer MD5s ---
Write-Host "[2] Sweeping Downloads/Temp for known-bad installer hashes..." -ForegroundColor Yellow
$badMD5 = @("03fd832b81dd54d2bf5f610a8ff27856","19e760ee849eb7c1f100f2b7010a763d","1f3031167f94b166cc7b69376a01c124","2dd8681dcd218c88d1c78dfe939ec92b","2ffdcfb7157511789228988e26d06fd6")
$sweepDirs = @("$env:USERPROFILE\Downloads", "$env:TEMP")
foreach ($dir in $sweepDirs) {
    Get-ChildItem -Path $dir -Recurse -File -Include *.exe,*.msi | ForEach-Object {
        $h = (Get-FileHash -Algorithm MD5 $_.FullName).Hash.ToLower()
        if ($badMD5 -contains $h) {
            $report += [PSCustomObject]@{ Check="Malicious Hash Match"; Path=$_.FullName; Version="N/A"; Risk="CRITICAL - Known FDMTP installer" }
        }
    }
}

# --- 3. Suspicious child processes of QuickFox (running now) ---
Write-Host "[3] Checking for QuickFox spawning script interpreters..." -ForegroundColor Yellow
$qf = Get-CimInstance Win32_Process -Filter "Name='quickfox.exe'"
foreach ($proc in $qf) {
    Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -eq $proc.ProcessId -and $_.Name -match 'rundll32|regsvr32|powershell|cmd|wscript|cscript|mshta' } | ForEach-Object {
        $report += [PSCustomObject]@{ Check="Suspicious Child Proc"; Path=$_.ExecutablePath; Version=$_.CommandLine; Risk="HIGH - Electron loader behavior" }
    }
}

# --- 4. DNS cache check for C2 domains ---
Write-Host "[4] Checking DNS cache for FDMTP C2 domains..." -ForegroundColor Yellow
$c2 = @("jiejie.net","icloud-cdn.net","cdns3.51quickfox.cn")
Get-DnsClientCache | Where-Object { $e=$_.Entry; $c2 | Where-Object { $e -like "*$_*" } } | ForEach-Object {
    $report += [PSCustomObject]@{ Check="C2 DNS Cache Hit"; Path=$_.Entry; Version=$_.Data; Risk="CRITICAL - C2 resolution observed" }
}

# --- 5. Active connections to C2 infrastructure ---
Write-Host "[5] Checking active network connections..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | ForEach-Object {
    try {
        $ptr = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
        foreach ($d in $c2) { if ($ptr -like "*$d*") {
            $report += [PSCustomObject]@{ Check="Active C2 Connection"; Path="$($_.RemoteAddress):$($_.RemotePort)"; Version=$ptr; Risk="CRITICAL" }
        }}
    } catch {}
}

# --- 6. Network sweep for Zbtlink/Wiflyer routers (run from mgmt host) ---
Write-Host "[6] Enumerating default gateway for Zbtlink MAC OUI / ENDLESSDOORS exposure..." -ForegroundColor Yellow
$gw = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Select-Object -First 1).NextHop
if ($gw) {
    $arp = Get-NetNeighbor -IPAddress $gw | Select-Object -First 1
    # Zbtlink OUIs - extend with known Shenzhen Zhibotong prefixes
    $zbtOUI = @("00:0C:43","C8:3A:35","78:A3:51")
    $mac = $arp.LinkLayerAddress
    foreach ($oui in $zbtOUI) {
        if ($mac -like "*$($oui.Replace(':','-'))*") {
            $report += [PSCustomObject]@{ Check="Possible Zbtlink Device"; Path="GW: $gw"; Version="MAC: $mac"; Risk="HIGH - Potential CVE-2026-66747 / ENDLESSDOORS exposure" }
        }
    }
    # Probe for rctl management interface signature
    try {
        $banner = (Invoke-WebRequest -Uri "http://$gw" -TimeoutSec 3 -UseBasicParsing).Content
        if ($banner -match 'zbtlink|zhibotong|wiflyer|rctl') {
            $report += [PSCustomObject]@{ Check="Zbtlink Banner Match"; Path="http://$gw"; Version="Banner fingerprint"; Risk="HIGH - Quarantine device pending CVE-2026-66747 review" }
        }
    } catch {}
}

# --- Report ---
Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Cyan
if ($report.Count -eq 0) { Write-Host "No indicators found on this host." -ForegroundColor Green }
else {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\SA_SupplyChain_Hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
    Write-Host "Results exported to CSV. Escalate CRITICAL/HIGH findings to IR immediately." -ForegroundColor Red
}