QuickFox VPN Supply Chain Attack Linked to APT Group
QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor
Related Entities
Threat Actors
Organizations
Products & Tech
Other
Full Report
Executive Summary
A sophisticated and long-running software supply chain attack has been uncovered targeting Windows users of QuickFox, a VPN and network acceleration tool popular among overseas Chinese users. The campaign, which has been active since at least August 2025, involves a trojanized version of the QuickFox installer. This malicious installer is used as a delivery mechanism for the FDMTP backdoor, a modular implant associated with the Chinese state-sponsored advanced persistent threat (APT) group also known as Mustang Panda or Twill Typhoon. The attack is highly targeted, fingerprinting victim machines and only deploying the final payload on systems of interest.
Threat Overview
The threat actor, assessed to be Twill Typhoon, compromised the software build or distribution process for the QuickFox application. They injected malicious code into the installer, which then selectively infects users. QuickFox is a legitimate tool used to accelerate access to websites and services in mainland China, giving the attackers a specific demographic to target.
The earliest known trojanized version of QuickFox was 3.0.51.0. Following a responsible disclosure from Fortinet FortiGuard Labs, the developers of QuickFox removed the malicious components in version 3.59.6.
Technical Analysis
The attack chain is multi-staged and demonstrates advanced tradecraft to evade detection and ensure selective targeting:
- Initial Access: The user downloads and runs the trojanized QuickFox installer for Windows. Malicious JavaScript code has been injected into an Electron renderer HTML file within the installer.
- Loader Download: This initial script connects to a typosquatted domain,
cdns3.51quickfox[.]cn, to download a second-stage JavaScript loader. - Victim Fingerprinting: The loader profiles the victim's machine. It checks for the presence of specific administrative tools, software development applications, translation software, or cryptocurrency-related applications. If the system does not match the target profile, the attack chain terminates.
- Payload Delivery: If the system is deemed a valid target, the loader proceeds to download and install the final payload, the FDMTP backdoor.
FDMTP is a modular backdoor that allows the attacker to perform reconnaissance, exfiltrate data, and download additional malicious modules for further exploitation.
MITRE ATT&CK Mapping
- T1195.002 - Compromise Software Supply Chain: The primary vector is the compromise of a legitimate software installer.
- T1059.007 - JavaScript: The initial stages of the attack are executed via malicious JavaScript.
- T1140 - Deobfuscate/Decode Files or Information: The multi-stage loading process likely involves decoding subsequent stages.
- T1571 - Non-Standard Port: APTs like Mustang Panda often use non-standard ports for C2 communications to blend in.
- T1608.004 - Typosquatting: The use of
cdns3.51quickfox[.]cnis a clear example of typosquatting a legitimate domain.
Impact Assessment
The impact on an infected organization or individual is significant. The FDMTP backdoor provides the attacker with a persistent foothold in the network, enabling long-term espionage. Given the targeted nature of the attack, the victims are likely to possess information of high value to the threat actor, such as intellectual property, government information, or financial data. For QuickFox, the incident causes severe reputational damage and a loss of user trust. This campaign highlights the risk of using software from less-established vendors and the sophistication of modern APT supply chain attacks.
IOCs — Directly from Articles
cdns3.51quickfox[.]cnCyber Observables — Hunting Hints
Security teams can hunt for activity related to this campaign by looking for:
*quickfox*.cnQuickFox.exeAppData\Local\QuickFoxDetection & Response
- Network Monitoring: Monitor for and block any network connections to the malicious domain
cdns3.51quickfox[.]cn. - Endpoint Detection: Use an EDR solution to detect the behavioral patterns of the FDMTP backdoor, such as suspicious process chains originating from
QuickFox.exeor the execution of reconnaissance commands. - Software Inventory: Maintain an inventory of all software installed on corporate devices. Scrutinize the use of niche applications like QuickFox and assess their security posture.
- Threat Intelligence: Integrate threat intelligence feeds that provide information on APT group TTPs and infrastructure to proactively hunt for their activity.
Mitigation
- Application Control: Use application control solutions like AppLocker or WDAC to restrict the execution of unauthorized software on corporate endpoints. This is a form of D3-EAL: Executable Allowlisting.
- Software Vetting: Establish a policy for vetting and approving all software before it is allowed on the corporate network. For approved software, ensure it is downloaded from official sources.
- User Education: While this is a supply chain attack, educating users about the risks of downloading software from unofficial sources is still a valuable layer of defense.
- Network Egress Filtering: Implement egress filtering to block outbound connections to unknown or untrusted domains, which can prevent the backdoor from connecting to its C2 server.
Timeline of Events
MITRE ATT&CK Mitigations
Execution Prevention
Use application allowlisting to prevent unauthorized software like QuickFox from running in a corporate environment.
Filter Network Traffic
Block connections to known malicious and typosquatted domains at the network perimeter.
Antivirus/Antimalware
Deploy EDR and AV solutions capable of detecting the FDMTP backdoor and its components.
D3FEND Defensive Countermeasures
The QuickFox supply chain attack relies on a user installing a non-standard, trojanized application. In a corporate environment, the most effective defense is to implement executable allowlisting using a tool like Windows Defender Application Control (WDAC). By creating a policy that only allows known, vetted, and signed applications to run, the organization can prevent employees from executing unauthorized software like QuickFox. This blocks the attack at the very first step, as the malicious installer would be prevented from running, regardless of whether it was downloaded from an official-looking site.
The attack chain for the FDMTP backdoor relies on connecting to a typosquatted C2 domain (cdns3.51quickfox[.]cn). By implementing DNS denylisting (also known as DNS filtering or sinkholing), organizations can block this connection at the network level. This can be done via a DNS firewall, a secure web gateway, or an enterprise DNS service. Even if a user manages to install the trojanized QuickFox application, this countermeasure will prevent the first-stage script from downloading the next-stage loader, effectively breaking the attack chain and preventing the final payload from being delivered.
Timeline of Events
The supply chain attack campaign targeting QuickFox is assessed to have begun.
Security researchers publicly disclose the details of the QuickFox supply chain attack.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.