Introduction
In Parts I-IV of this series, we reported on a large-scale malware delivery network targeting Chinese speaking users. This cluster is frequently associated with the Silver Fox threat group and relies on thousands of typo-squatted domains. We noted previously that this infrastructure appeared to operate under an affiliate or Malware as a Service (MaaS) model. In mid June 2026, Chinese law enforcement reportedly arrested several individuals connected to Silver Fox operations. Despite this, the delivery network remained active. Multiple distinct affiliates continued registering hundreds of new malicious domains just days after the arrests. To keep these new campaigns online, the operators are blending localized .com.cn domains with abused legitimate services. We are currently tracking payloads hosted on GitHub release assets, Microsoft Store redirects, and enterprise cloud buckets across AWS, Google Cloud, and Alibaba.
The attackers behind these campaigns use software trends to maximize their infection rates. Their targeting changes based on whatever applications are currently dominating the Chinese market. Two years ago, their landing pages primarily spoofed web browsers and VPNs. Over the past year, they have capitalized heavily on the artificial intelligence boom by distributing fake installers for DeepSeek and Doubao. Regardless of the affiliate or the specific software being spoofed, the underlying infection chain identified in this campaign looks nearly identical. Victims receive a heavily modified Gh0stRAT variant hidden inside installers padded to over 100MB, which allows the malware to bypass file size limits on automated sandboxes. The execution process involves OLLVM obfuscation, a UAC bypass, and Reflective DLL Injection (sRDI) to load the malware directly into legitimate system processes. Once active, the payload communicates with its command and control servers using a custom network stack built on the hp-worker library.
Infrastructure and Lure Variations
Continuous monitoring of this cluster indicates the actor is rapidly diversifying both their distribution methods and their malware lures. While previous campaigns relied heavily on newly registered domains (NRDs), recent activity shows a systemic integration of abused legitimate services to bypass DNS reputation filtering. Analysis of the delivery URLs indicates the actor is hosting payloads across major cloud providers. Observed infrastructure used by the actor previously includes Alibaba Cloud OSS (doubaoaa.oss-cn-hongkong.aliyuncs[.]com), AWS S3 (dfgdhgg.s3.ap-east-1.amazonaws[.]com), and Google Cloud Storage (storage.googleapis[.]com). Additionally, the actor utilizes dynamic linking services like Branch.io (app[.]link), manipulates GitHub release assets, and abuses Microsoft Store search redirects (apps.microsoft[.]com).
To build trust on their landing pages, the actor frequently includes legitimate links to the Apple App Store and Google Play Store for mobile users, while serving the malicious payloads strictly to users downloading the Windows or macOS desktop executables.
Expansion of Spoofed Targets
While the actor continues to target users seeking foreign access and trading platforms (ProtonVPN, NordVPN, MetaTrader 5, AICoin), they are increasingly spoofing domestic Chinese software.
Notable additions to the spoofing infrastructure include:
- Artificial Intelligence: Capitalizing on current trends, the actor has registered domains spoofing DeepSeek (ai-deepseekapp[.]com[.]cn) and Doubao AI.
- Enterprise and Productivity: Lures include DingTalk (Alibaba’s enterprise communication platform), Baidu Netdisk, and Quark Browser.
- Security Software: The actor is distributing payloads masquerading as Huorong Security (down.app-huorong[.]cn), a widely used Chinese antivirus and endpoint protection platform.
Post-Arrest and the Affiliate Model
In mid-June 2026, reports indicated that Chinese law enforcement executed arrests targeting operators associated with the Silver Fox malware campaigns. However, pivot analysis of the domain infrastructure reveals that these campaigns continue to be active.
Between June 17 and June 27, 2026, over 400 new malicious domains were registered and provisioned with active hosting. This sustained operational tempo validates a hypothesis generated in Part IV of this series: the malware delivery "super-cluster" operates as a decentralized Malware-as-a-Service (MaaS) platform. Rather than a single monolithic threat actor, the infrastructure is utilized by multiple distinct affiliates or operators who bring their own lures and targeting preferences while utilizing a shared baseline of Gh0stRAT-style payloads and obfuscation tooling.
Infrastructure pivot analysis isolates at least three highly distinct operational profiles active in the post-arrest window:
Cluster 1:
The most prolific active cluster is operated by an entity utilizing the email 7cf560423@baituo[.]io and the registrant name "徐涛" (Xu Tao). This operator registered 322 domains in the 10 days following the reported arrests.
- TTPs: This operator utilizes a highly rigid, automated infrastructure deployment model. They provision exactly one dedicated Alibaba Cloud HK IP address per spoofed brand campaign. For example, all recent Surfshark lures resolve to 8[.]210[.]120[.]164, Kraken Exchange lures to 47[.]239[.]173[.]17, and Baidu Wangpan lures to 8[.]210[.]196[.]194.
- Targeting: This operator focuses heavily on mass-market VPNs, cloud storage, and trending AI tools (DeepSeek, Tencent Yuanbao, Doubao).
Cluster 2:
A second distinct operator utilizes the email 3799492994@qq[.]com and the registrant name "崔勇强" (Cui Yongqiang). This actor registered 113 domains in the post-arrest window.
- TTPs: Like Cluster 1, this operator provisions dedicated Alibaba Cloud HK IPs (ASN 401696), but groups their infrastructure by specific deployment dates rather than strictly by brand.
- Targeting: This actor exhibits a highly targeted focus on financial and enterprise platforms. Lures exclusively target users of MetaTrader 4, MetaTrader 5, TradingView, AiCoin, and specialized enterprise customer service applications like WangshangLiao (旺商聊) and KefuBao (客服宝).
Cluster 3:
A third, smaller cluster operates independently from the Alibaba Cloud infrastructure, utilizing a Hong Kong hosting provider named LucidaCloud and the email daliandahouzi@gmail[.]com ("da houzi").
- Targeting: This operator specifically targets futures trading platforms, utilizing unique lures such as "奇货神器" (Rare Goods Magic Weapon - a futures trading decision platform).
Traffic Redirection and Analytics Tracking
Consistent with findings in Part II, the operators continue to leverage tracking pixels and redirect hubs to manage campaign traffic. Analysis identified the continued use of Google Analytics 4 (GA4) tags (e.g., G-3GR90RW2M5) embedded across crypto-wallet phishing sites (imToken, AiCoin) to monitor victim interaction.
Additionally, the operators utilize centralized redirect hubs. Domains such as osnenfae[.]xyz (impersonating the OpenClaw AI agent) do not host payloads directly. Instead, these domains function as traffic directors, routing victims to central hubs like opencnwl.com[.]cn where the actual payload delivery mechanisms are hosted. This compartmentalization of infrastructure complicates takedown efforts, as defenders must identify and block both the outer redirector ring and the inner payload hosting hubs.
Sample Sites Spoofing Malicious Software:
 |  |
 |  |
 |  |
 |  |
 |  |
 |  |
 |  |
 |  |
 |  |
 |  |
Malware Analysis: Modified Gh0stRAT Delivery
The majority of samples analyzed from this recent cluster point to an obfuscated variant of Gh0stRAT. The infection chain utilizes a multi-stage dropper process involving bloated installers, steganography, and compiler-based obfuscation. For the samples reviewed in this campaign, the technical execution chain, obfuscation methods, and final payload structure are nearly identical regardless of the lures.
Inno Setup Bundles
Validating observations from Part IV, the initial payloads are Inno Setup executables artificially padded to sizes ranging from 117MB to over 147MB. The padding is an anti-analysis technique designed to exceed the file size limits of public sandboxes, and security gateways, which are typically around 100-200 MB and subsequently deter automated analysis.
Extracting the Inno Setup files reveals legitimate, digitally signed application binaries bundled with malicious components. In several of the applications observed, the file bundles contain dozens of legitimate applications that serve no purpose other than to increase the file size and the overall application's legitimacy. The setup script utilizes the hidewizard nowait directive, which presents the user with a standard installation GUI while the malicious loader executes silently in the background.
Following the installation routine, execution passes to a 64-bit loader (e.g., XwLOZ.exe). Code analysis of the loader indicates it is heavily obfuscated utilizing OLLVM (Obfuscator-LLVM) and VMProtect/Themida-style protections to complicate control flow analysis. The loader’s primary function is to map a companion DLL (e.g., GQucUJ.WLs) into memory and execute its various exports.
Once mapped, the DLL searches the local file system for a specific data file dropped during the initial installation phase (e.g., DsHeEOJ6.bG). All DLLs analyzed share the same obfuscation compiler as the EXE loader component.
Payload Decryption
The DsHeEOJ6.bG file is structured to masquerade as an 800x600 PNG image, utilizing the standard %PNG (47 4e 50 89) magic bytes in its header. The DLL allocates a ~10MB memory segment with Read-Write (RW) permissions, removes the PNG headers, and decrypts the underlying payload. Following decryption, it uses VirtualProtect to modify the memory permissions to Read-Write-Execute (RWE) and redirects execution to the decrypted shellcode.
The decrypted shellcode is based on an sRDI (Reflective DLL Injection) implementation and uses the RtlDecompressBuffer API to unpack an embedded PE file into a new memory region.
The shellcode injects the final unpacked DLL payload as a headless PE into a separate, legitimate system process. In observed instances, the malware targets sihost.exe (Shell Infrastructure Host). By executing exclusively within the context of a trusted system process, the malware blends its subsequent network and file operations with normal operating system behavior. Additionally a lightweight watchdog DLL is injected into a separate system process such as uhssvc.exe (Microsoft Update Health Tools). It is worth noting that the DLL payload uses the same obfuscation compiler as the loader EXE and DLL, but the watchdog DLL does not.
To ensure continuous execution of the injected Gh0stRAT payload, the malware establishes a local watchdog mechanism. It drops a batch file into the C:\Windows\ directory utilizing a randomized 8-character filename (e.g., C:\Windows<random_8_chars>.bat). The contents of this script are obfuscated, but de-obfuscation reveals a continuous monitoring loop utilizing system utilities:
If the tasklist command returns an error, indicating the injected uhssvc.exe process has been terminated, the batch script issues an sc start command to restart the obfuscated malicious service, effectively functioning as a persistent watchdog for the main Gh0stRAT process.
To facilitate execution within protected system boundaries and establish service-based persistence, the payload first performs a User Account Control (UAC) bypass. It achieves this by abusing the ICMLuaUtil elevated COM interface (CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This allows the malware to silently elevate its privileges without prompting the user.
Configuration and Capabilities
Prior to initiating network communications, the injected payload reads its configuration from a hardcoded path: C:\ProgramData\C46EEF09DFB549819FACDBF1C9081293\config.ini.
The configuration file is XOR-encrypted using a static 0x62 key. Decryption yields operational parameters, versioning (version=s9C4pg==), and campaign group identifiers (e.g., group=tLa0uLa4tLim).
Secondary persistence is established by copying an executable to a randomized path within the C:\msys64\ directory (e.g., C:\msys64\IHGW\qqit\aqzaeX\wKBe\yD4C7.exe). This executable is registered and launched as a service via cmd.exe.
Analysis of the unpacked payload confirms the core capabilities of Gh0stRAT. Extracted API calls show standard GDI and GDI+ functions (GdipCreateBitmapFromHBITMAP, BitBlt, StretchBlt) for screen capture, as well as SetWindowsHookExW and GetAsyncKeyState for keylogging. The payload utilizes WMI queries (ROOT\CIMV2) for system enumeration.
The payload also contains strings indicating targeted data collection and evasion. It queries specific paths for WeChat, Telegram, and regional browsers (e.g., %s\360se6\User Data\Default, NoLogWechat, NoLogTG). Additionally, the code checks for the presence of 360Hvm64.sys, a component of Qihoo 360 security software, indicating specific anti-analysis measures for Chinese operating systems.
Command and Control (C2)
Code analysis reveals class structures such as CTcpPackClientT, IPackClient, and CTcpClient, indicating the use of hp-worker (High-Performance Socket), an IOCP-based C++ networking library. This aligns with past observed behavior of other Gh0stRAT variants, which also utilize updated C++ network libraries to manage asynchronous data streams.
Alternative Gh0stRAT Variant:
While the OLLVM/Inno Setup chain is the most prevalent in this cluster, analysis of AiCoin lures (e.g., AIcosin_x64.exe) revealed a distinct, secondary infection chain.
Like the primary variant, the initial installer is padded (~163MB); however, it utilizes an Advanced Installer package rather than Inno Setup. Execution relies on a DLL sideloading against a legitimate dropped executable (e.g., BrowserProtect.exe). The malicious DLL (DataState.dll) is 20MB in size and, notably, is signed with a valid Authenticode certificate issued to a Chinese company ("Shanxi 90s Catering Management Co., Ltd."). The use of a valid, stolen, or otherwise fraudulently obtained certificate allows the payload to bypass initial Mark-of-the-Web (MoTW) and endpoint trust checks.
This alternative chain lacks the compiler-level obfuscation seen in the primary variant. An injected DLL decrypts the final embedded payload, which matches publicly available Gh0stRAT code.
Indicators of Compromise (IoCs)
Inno Setup Installer Cluster
The majority of these samples share a common pattern: 32-bit Inno Setup installers built with a Delphi (XE2–XE6) compiler and Turbo Linker. Each drops 3 embedded files and beacons to 2 C2 addresses (a domain + an IP:port pair).
Obfuscated Gh0stRAT Variant
Gh0stRAT Variant v2
Payload Delivery Domains and Lure Domains are available in the DTI IoC Library on GitHub.
