Affected Systems

Organizations with China-based operations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Campaign impersonates popular software vendors (Razer, Microsoft Edge, Kaspersky, Calibre, DiskGenius, Baidu, and others) via spoofed .com.cn and .hl.cn domains delivering dynamically regenerated malicious installer archives.

Exploitation Status

Active exploitation confirmed. Microsoft Defender Experts is tracking ongoing campaign with confirmed compromises across multiple organizations. Attackers use server-side payload regeneration to evade hash-based detection. Microsoft Defender has detected and disrupted activity across multiple attack stages.

Business Impact

Successful compromise results in persistent malware implants that weaken security protections and establish command-and-control communication. Attack chain includes privilege escalation and defense evasion capabilities. Primary risk to multinational organizations with China operations and users downloading software from search results or third-party sources. Campaign targets broad range of popular legitimate software, increasing likelihood of user interaction.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block known malicious domains and delivery infrastructure listed in Microsoft's IOC set, including gehie246[.]com, yimxg25tiy[.]com, cc8ttkv35b[.]com, n7b8t85zsg[.]com and associated .com.cn/.hl.cn impersonation domains
  • Enable and enforce Microsoft Defender SmartScreen, network protection, and tamper protection to block downloads from untrusted sources and prevent security setting modifications
  • Implement application control policies to restrict execution of unsigned or untrusted installers, particularly those downloaded from non-official vendor sources
  • Hunt for FileOriginReferrerUrl telemetry pointing to .com.cn and .hl.cn domains with embedded brand names, and investigate any app_setup.*, zinst.*, zintall.*, intsoft.*, or innstll.* archives
  • Educate users in China-based operations to download software exclusively from official vendor websites and verify domain authenticity before downloading executables