Do Son 
At a Glance
| Attribute | Detail |
|---|---|
| Malware family | FDMTP implant (.NET, TouchSocket-based) |
| Threat actor | Suspected Twill Typhoon (not confirmed) |
| Target / victims | Windows users of QuickFox, mainly Chinese students and expats abroad |
| Delivery vector | Trojanized QuickFox installer (supply chain attack) |
| Key capabilities | Endpoint fingerprinting, plugin loading, data collection |
| Source | FortiGuard Labs |
TL;DR
FortiGuard Labs uncovered a QuickFox supply chain attack that deploys the FDMTP implant. The campaign trojanizes a popular VPN and game accelerator to target Windows users. It has been active since at least August 2025, and its infrastructure remains live.
Why This Supply Chain Attack Matters
QuickFox is a VPN proxy and game accelerator. Chinese users abroad rely on it to reach services back home. As a result, a poisoned installer reaches a specific, hard-to-monitor user base.
The QuickFox supply chain attack shows how attackers hide inside trusted software. FortiGuard Labs notes the infrastructure “continues to be active at the time of publishing.” Therefore, the risk is ongoing, not historical.
How the QuickFox Supply Chain Attack Works
Attackers trojanized the installer with a small change. According to FortiGuard Labs, “The installer executable was trojanized by adding two lines of JavaScript to a single HTML file.” That file runs inside the QuickFox Electron app during startup.
Those two lines pull JavaScript from a lookalike domain. The domain swaps the real “.com” address for a “.cn” version through typosquatting. One file is real Firebase code. The other is a heavily obfuscated loader.
Target Filtering
The loader checks the victim before going further. First, it confirms the host runs Windows. Next, it scans running processes. It exits if “steam.exe” appears, which likely skips home gaming PCs.
The script then looks for 26 other processes. These include developer tools, database clients, crypto wallets, and Chinese translation apps. If a match exists, the attack continues.
Infection Chain and the FDMTP Implant
Once validated, the loader downloads an “update.zip” archive. Inside sits a legitimate Microsoft binary, “csmonitor.exe.” That binary sideloads a trojanized DLL, a classic DLL hijack (T1574.001).
The DLL then unpacks the FDMTP implant, “Client.dll.” It carries 15 compressed modules for its operations. FortiGuard Labs observed two loader generations, which points to steady development.
Command and Control
The implant first contacts a hardcoded staging domain. That server returns a short, encoded list of C2 nodes and ports. The implant then opens an FDMTP socket to those clusters.
After a handshake, the C2 requests device details. Collected data covers the OS, username, network addresses, and installed antivirus. The malware serializes and compresses this before sending it back.
Notably, the implant runs mostly through pushed plugins. The server stores a plugin in the registry, then triggers it on demand. FortiGuard Labs saw little activity beyond this enumeration.
Attribution
FortiGuard Labs does not confirm who runs this campaign. However, it reports strong technical overlap with activity linked to Twill Typhoon. This is suspected attribution, not confirmed attribution.
The overlap includes shared C2 cluster IPs and matching sideloading tradecraft. The final FDMTP payload also matches earlier Darktrace reporting. You can read the full technical analysis in the FortiGuard Labs report.
Affected Versions and Defense Guidance
The trojanized code hit Windows builds only. FortiGuard Labs flags versions above v3.0.35 and below v3.55.6 as affected. QuickFox removed the malicious components starting in v3.59.6 after Fortinet’s notice.
Defenders should audit QuickFox installs on managed Windows hosts. Additionally, watch for csmonitor.exe running from temporary user folders. Treat lookalike “.cn” domains and unexpected registry writes under the IME key as warning signs. No active exploitation of QuickFox Cloud components was confirmed.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
