QuickFox Supply Chain Attack: Detection and Response for FDMTP Malware

---
title: QuickFox Trojanized Installer Execution
id: 8a5f2c91-4d73-4e8f-9a1b-7c6e5d4a3b2c
status: experimental
description: Detects execution of potentially trojanized QuickFox installer which has been identified as delivering FDMTP malware via supply chain attack.
references:
  - https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.supply_chain
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\msiexec.exe'
    CommandLine|contains:
      - 'QuickFox'
      - 'quickfox'
  condition: selection
falsepositives:
  - Legitimate QuickFox installation (verify source integrity)
level: high
---
title: FDMTP Unusual Network Activity
id: 3b7c6d42-9e1a-4f5c-8b2d-1a4e5c8f7d3e
status: experimental
description: Detects network behavior consistent with FDMTP unauthorized access mechanism delivered via QuickFox supply chain attack.
references:
  - https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.c2
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort|between:
      - 8000
      - 9000
  filter:
    Image|endswith:
      - '\quickfox.exe'
      - '\QuickFox.exe'
  condition: selection and not filter
falsepositives:
  - Other VPN applications using similar ports
level: medium
---
title: FDMTP Process Persistence Mechanism
id: 6d9e2f48-5b7c-4a3e-9d1f-8c7b6a5d4e3c
status: experimental
description: Detects persistence mechanisms potentially associated with FDMTP malware delivered via trojanized QuickFox installer.
references:
  - https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.persistence
  - attack.t1543
  - attack.create_service
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'FDMTP'
      - 'fdmtp'
  condition: selection
falsepositives:
  - Unknown
level: critical

// Hunt for QuickFox installer executions in the last 30 days
DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName =~ "msiexec.exe" and ProcessCommandLine contains "QuickFox"
| extend SourceIP = InitiatingProcessAccountName, Hostname = DeviceName
| project Timestamp, Hostname, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for FDMTP-related network connections
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where RemotePort between (8000 .. 9000)
| where not(InitiatingProcessFileName has "quickfox")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| order by Timestamp desc

// Check for FDMTP persistence via service creation
SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 4688
| where NewProcessName contains "sc.exe" and CommandLine contains "FDMTP"
| project TimeGenerated, Computer, SubjectUserName, NewProcessName, CommandLine
| order by TimeGenerated desc

-- Hunt for QuickFox installation artifacts
SELECT FullPath, Mtime, Atime, Size, SHA256
FROM glob(globs="C:\\Program Files\\QuickFox\\*")
WHERE NOT FullPath =~ 'uninstall'

-- Check for FDMTP-related services
SELECT Name, DisplayName, State, StartMode, PathName, ProcessId
FROM wmi(query="SELECT * FROM Win32_Service WHERE Name LIKE '%FDMTP%' OR DisplayName LIKE '%FDMTP%'")

-- Hunt for suspicious network connections on FDMTP-associated ports
SELECT Family, RemoteAddress, RemotePort, State, Pid, ProcessName, StartTime
FROM netstat()
WHERE RemotePort > 8000 AND RemotePort < 9000 AND NOT ProcessName =~ 'quickfox'

# QuickFox Supply Chain Attack Remediation Script
# Author: Security Arsenal
# Date: 2026-08-15

Write-Host "Starting QuickFox/FDMTP Remediation Process..." -ForegroundColor Yellow

# Check if QuickFox is installed
$quickfoxPaths = @(
    "$env:ProgramFiles\QuickFox",
    "${env:ProgramFiles(x86)}\QuickFox",
    "$env:LOCALAPPDATA\QuickFox"
)

$quickfoxInstalled = $false
foreach ($path in $quickfoxPaths) {
    if (Test-Path $path) {
        $quickfoxInstalled = $true
        Write-Host "QuickFox found at: $path" -ForegroundColor Red
    }
}

if ($quickfoxInstalled) {
    # Kill QuickFox processes
    Write-Host "Terminating QuickFox processes..." -ForegroundColor Yellow
    Get-Process | Where-Object { $_.ProcessName -like "*quickfox*" } | Stop-Process -Force -ErrorAction SilentlyContinue

    # Check for FDMTP services
    Write-Host "Checking for FDMTP services..." -ForegroundColor Yellow
    $fdmtpServices = Get-WmiObject -Class Win32_Service | Where-Object { $_.Name -like "*FDMTP*" -or $_.DisplayName -like "*FDMTP*" -or $_.PathName -like "*FDMTP*" }
    
    if ($fdmtpServices) {
        foreach ($service in $fdmtpServices) {
            Write-Host "Found FDMTP service: $($service.Name) - $($service.PathName)" -ForegroundColor Red
            Stop-Service -Name $service.Name -Force -ErrorAction SilentlyContinue
            & sc.exe delete $service.Name
        }
    } else {
        Write-Host "No FDMTP services found." -ForegroundColor Green
    }

    # Check for FDMTP scheduled tasks
    Write-Host "Checking for FDMTP scheduled tasks..." -ForegroundColor Yellow
    $fdmtpTasks = Get-ScheduledTask | Where-Object { $_.TaskName -like "*FDMTP*" -or $_.Actions.Execute -like "*FDMTP*" }
    
    if ($fdmtpTasks) {
        foreach ($task in $fdmtpTasks) {
            Write-Host "Found FDMTP task: $($task.TaskName)" -ForegroundColor Red
            Unregister-ScheduledTask -TaskName $task.TaskName -Confirm:$false
        }
    } else {
        Write-Host "No FDMTP scheduled tasks found." -ForegroundColor Green
    }

    # Remove QuickFox installation
    Write-Host "Removing QuickFox installation..." -ForegroundColor Yellow
    foreach ($path in $quickfoxPaths) {
        if (Test-Path $path) {
            Remove-Item -Path $path -Recurse -Force
            Write-Host "Removed: $path" -ForegroundColor Green
        }
    }

    # Check registry for QuickFox persistence
    Write-Host "Checking registry for QuickFox persistence..." -ForegroundColor Yellow
    $registryPaths = @(
        "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
        "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
        "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
        "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
    )
    
    foreach ($regPath in $registryPaths) {
        $quickfoxReg = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue | Get-Member | Where-Object { $_.Name -like "*QuickFox*" -or $_.Name -like "*FDMTP*" }
        if ($quickfoxReg) {
            foreach ($item in $quickfoxReg) {
                Write-Host "Found registry persistence: $($item.Name) in $regPath" -ForegroundColor Red
                Remove-ItemProperty -Path $regPath -Name $item.Name -Force -ErrorAction SilentlyContinue
            }
        }
    }

    Write-Host "QuickFox removal complete. System reboot recommended." -ForegroundColor Green
} else {
    Write-Host "QuickFox not found on this system." -ForegroundColor Green
}

# Perform network connection check for FDMTP-associated ports
Write-Host "Checking for active FDMTP-associated network connections..." -ForegroundColor Yellow
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -ge 8000 -and $_.RemotePort -le 9000 } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($process -and $process.ProcessName -notlike "*quickfox*") {
        Write-Host "Suspicious connection found: $($_.RemoteAddress):$($_.RemotePort) by $($process.ProcessName) (PID: $($_.OwningProcess))" -ForegroundColor Red
    }
}

Write-Host "Remediation script completed." -ForegroundColor Green