Four Million Malware Reports Reveal a Widespread No-DNS C2 Blind Spot

A long‑running supply chain compromise of the QuickFox VPN accelerator that quietly delivered an FDMTP backdoor to carefully profiled Windows systems, exposing a major blind spot in defenders’ visibility where command‑and‑control (C2) traffic never touches traditional DNS.

The attackers added just two lines of JavaScript to an internal Electron renderer HTML file, causing the app at startup to fetch “firebase‑analytics‑compat.js” (legitimate Firebase code).

A heavily obfuscated “firebase‑app‑compat.js” loader from a typosquatted domain, cdns3[.]51quickfox[.]cn, instead of the legitimate 51quickfox[.]com infrastructure.

Once executed, the JavaScript loader fingerprints the endpoint, validates that it is running Windows, checks in with C2 to avoid re‑infection, and enumerates running processes via tasklist.

It immediately aborts if Steam is present, and only proceeds if at least one of 26 targeted processes is detected, including SSH/database tools (Xshell, Navicat, DBeaver), IDEs and editors (IntelliJ, VS Code, Sublime Text).

Crypto wallets and exchange clients (Exodus, Binance, Ledger, Trezor), and a broad set of Chinese‑language translation and cross‑border commerce tools.

This client‑side victim filtering strongly suggests a focus on professional, administrator, and China‑facing business environments rather than casual gaming endpoints.

When targeting conditions are met, the loader retrieves an “update.zip” archive from cdns3[.]51quickfox[.]cn and extracts it into a QuickFox temp path before executing a legitimate Microsoft binary, csmonitor.exe (Windows Azure Compute and Storage Emulator).

This binary is abused to sideload a malicious Microsoft.ServiceHosting.Tools.dll that in turn loads the FDMTP implant:

Generation 1 (from at least September 2025) embeds the FDMTP payload directly as Client.dll inside the DLL loader.

Generation 2 (seen from May 2026) moves to a more survivable design: Microsoft.ServiceHosting.Tools.dll functions as an obfuscated loader (protected with JieJie .NET Protector), decrypting an AES‑128‑ECB encrypted update.bin using a hardcoded key matching prior FDMTP reporting by Darktrace, then loading the same Client.dll FDMTP module.

Because QuickFox is an Electron app, all of this runs in noisy child processes spawned under QuickFox.exe, with extensive cmd.exe activity and .NET components, blurring process lineage and complicating EDR detection.

The FDMTP implant (Client.dll plus 15 compressed supporting modules) registers a Costura‑style assembly resolver to decompress and dynamically load its internal modules, significantly degrading static analysis.

It then executes Client.Program.InitConnect(), which contacts staging domains like www[.]icloud‑cdn[.]net, www[.]google‑apis[.]net, and multiple “wangmeng” look‑alike hostnames using API paths such as /GetCluster, /GetSlaver, /GetEndpoints, and related function names.

These staging frontends respond with base64‑encoded, gzip‑compressed lists of two IP:Port pairs per request, typically in the 20800–20816 range, which the implant uses to establish FDMTP socket connections directly to cluster nodes such as 47[.]238[.]64[.]56, 154[.]223[.]58[.]64, and 38[.]60[.]142[.]56.

Crucially, this model decouples staging lookups from DNS‑observable indicators defenders typically rely on: once the target has retrieved IP:Port tuples, subsequent C2 flows are direct TCP FDMTP communications, negotiated via custom “00 01”, “00 04”, “00 14”, and “00 15” flag packets and RPC calls.

FortiGuard Labs is tracking a campaign QuickFox, a VPN proxy and game accelerator popular with overseas Chinese users, was weaponized via a trojanized Windows installer that has been active since at least August 2025.

The framework supports rich remote control capabilities via plugins pushed over the FDMTP channel and stored in HKCUSOFTWAREMicrosoftIME{HWID}, with operations such as GetInfo, EnumProcessByJson, IsRegistryPlugin, RegistryPlugin, RunPlugin, and StartProcess.

Widespread No-DNS C2 Blind Spot

In observed cases, plugins like Assist.dll deployed additional payloads into %LocalAppData%MicrosoftWindowsApps, but FortiGuard did not see heavy post‑exploitation beyond detailed host enumeration, aligning with espionage‑style staging.

FortiGuard Labs stops short of formal attribution but notes substantial overlap with Darktrace’s independently reported FDMTP campaign, assessed as linked to the China‑nexus cluster known as Twill Typhoon/Mustang Panda.

Darktrace previously documented CDN‑masquerading infrastructure, DLL sideloading access via Sogou Pinyin, and a modular Client.TcpDmtp FDMTP backdoor communicating through /GetCluster and similar APIs to updated FDMTP v3.2.5.1 clusters.

The QuickFox campaign reuses core tradecraft: legitimate Windows binaries as hosts, side‑loaded .NET loaders, staging domains mimicking global providers, and the same AES key and FDMTP architecture, but pivots to a supply chain vector against a niche, China‑centric VPN accelerator.

For defenders, this cross‑campaign technical continuity demonstrates how high‑confidence open‑source intelligence on one FDMTP operation can directly support detection of another, even when payload filenames, infrastructure labels, and victim populations change.

Following FortiGuard’s responsible disclosure, QuickFox removed the malicious components from its Windows installer as of v3.59.6, with trojanized versions traced between 3.0.51.0 and 3.59.5 and no evidence of active compromise on iOS or Android builds.

The campaign’s persistence into mid‑2026, evolving loader generations and staging domains, and its careful selection of Windows‑only professional targets underscore how supply chain compromises against region‑specific apps can quietly bypass traditional DNS‑centric C2 detection and remain operational for years.

Organizations should treat Electron‑based consumer tools, language input methods, and region‑specific accelerators as potential enterprise ingress points, instrument supply chain risk beyond “official” business software.

FDMTP‑style modular C2 frameworks that resolve cluster nodes via application‑level APIs rather than relying on predictable DNS patterns.

Leveraging Fortinet and Darktrace’s FDMTP indicators, staging domains, and behavioral sequences provides an immediate opportunity to close this no‑DNS C2 blind spot before attackers pivot the same framework to new front‑end applications.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide