{
  "id": "silver-fox-g03-tonghuashun",
  "url": "https://ohshit.app/incidents/silver-fox-g03-tonghuashun/",
  "title": "Silver Fox G03 spreads through fake Tonghuashun installers",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-10",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Silver Fox",
    "Windows",
    "search poisoning"
  ],
  "ecosystems": [],
  "summary": "CNCERT and Beijing Guancheng Technology traced a campaign that uses search poisoning and lookalike stock-trading downloads to install a Windows remote-access trojan. CNCERT counted 25,164 controlled endpoints in China from October 4 to November 2.",
  "splash": "Windows users who ran the fake Tonghuashun installer. The payload can capture screens and keystrokes, run commands, and load plugins.",
  "wipe": "Isolate suspected hosts, hunt the published indicators, and reset credentials used on affected devices from a clean system.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Isolate and preserve evidence",
      "hint": "Disconnect endpoints that ran the installer or show multiple related signals. Preserve the download, process and registry telemetry, DNS and outbound connections. Check the HKCU Run value SystemKKfile and Microsoft.exe in %TEMP%, and inspect scheduled tasks."
    },
    {
      "title": "Hunt and contain across the fleet",
      "hint": "Search endpoint and egress telemetry for the defanged indicators below and the additional infrastructure indicators below. Block campaign infrastructure at egress and run a full endpoint scan. Correlate shared infrastructure matches with host activity."
    },
    {
      "title": "Recover from trusted media and secure accounts",
      "hint": "Remove malicious artifacts and persistence. Reimage endpoints with confirmed remote control from trusted media. From a clean device, reset credentials used on affected hosts, revoke sessions, and review brokerage account activity. Obtain the replacement installer directly from the vendor or a trusted store."
    }
  ],
  "sources": [
    {
      "name": "CNCERT and Beijing Guancheng Technology analysis",
      "url": "https://www.cert.org.cn/portal/yjtb/eydmtb/2026/11/27ae286da3f0454ead6047d81b8b8b90.htm",
      "says": "Documents the installer, affected endpoint telemetry, behavior and indicators.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "CNCERT observed bot activity and documented the staged payload.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 10, 2026",
      "title": "CNCERT and Guancheng publish the G03 analysis",
      "body": "The report documents the installer chain, October 4 to November 2 telemetry, and the full indicator list."
    }
  ],
  "body_markdown": "The campaign drew users to a fake download center through search manipulation and keyword ads. Running the unsigned `THS.exe` from `THS.zip` starts the `Microsoft.exe` loader alongside a genuine signed Tonghuashun installer. The loader persists at user logon and retrieves a remote-control module over TCP. The researchers’ 25,164 count covers controlled endpoints across the group’s monitored domestic infrastructure during the stated period. The report gives no count of affected brokerage accounts or confirmed financial losses.\n\nSection 8 indicators are defanged below. The original report marks the initial two URLs and the first three C2 entries inactive at publication. Its infrastructure table also identifies four lookalike domains for investigation.\n\n```text\nhttps[:]//lojqka[.]com\nhttps[:]//dowmasfz[.]cv/THS.zip\n43.199.114[.]131:7777\n52.223.22[.]103:2026\n76.223.113[.]170:6789\n134.122.155[.]140\n204.194.50[.]202\n143.92.40[.]155\n134.122.189[.]47\n143.92.40[.]243\n134.122.155[.]157\n118.107.44[.]141\n134.122.204[.]118\n134.122.200[.]118\n134.122.155[.]105\n154.201.82[.]55\n118.107.47[.]92\n134.122.204[.]71\n134.122.129[.]44\n134.122.189[.]31\n1.32.250[.]70\n134.122.155[.]16\n134.122.129[.]33\n103.101.176[.]18\n143.92.40[.]244\n118.107.44[.]226\n143.92.43[.]162\n134.122.155[.]14\n134.122.155[.]150\n143.92.37[.]202\n134.122.189[.]27\n118.107.44[.]15\nyhao.sxkj999[.]vip\nhk3.1984233[.]xyz\ntj.edatonee[.]com\nafa.sxkj999[.]vip\nwww.khop112[.]cfd\nahua.sxkj999[.]vip\ngcheng.sxkj999[.]vip\nlaomo.sxkj999[.]vip\ndan.sxkj999[.]vip\nyifan.sxkj999[.]vip\nhaiwen.sxkj999[.]vip\ntest.nanhuasell[.]com\nandi.sxkj999[.]vip\nfour.x517l[.]com\nxsi.sxkj999[.]vip\ncchen.sxkj999[.]vip\nae4697dc3688a45299a038e4b3d08df55a25dd4484273f63ae8922d80f765d35\nc7fc37bc64f00c3aaf8422737a4c11ccb2d682ad283c0191e40c3b0fe7861279\n413bbbcb3d3a0a97da6fbdbb71a92ce048c1016acfaf3cafbd5e58b1c6cb1008\n```\n\nAdditional domains, paths, hashes and endpoint context from the infrastructure and sample tables. Correlate shared CDN IPs with hostnames, paths and endpoint behavior before acting on a match.\n\n```text\n10jqkaapp[.]com\n10jqkapc[.]com\nl0jqka[.]com\nl0jqka[.]ai\nhttps[:]//lojqka[.]com/download\n/skin/images/texiao1.png\n53b7e792ab43ba2d529772c18f133dc62fd6d54e0139cf6cd7847eac8ddf07ee\n736da9b2cab1ef70c2973cc211c5636a\n134.122.204[.]71:443\n134.122.155[.]157:443\n143.92.40[.]155:443\n134.122.155[.]140:443\n172.67.136[.]42\n13.113.93[.]176\n104.21.80[.]194\n172.67.153[.]78\n104.21.59[.]154\n172.67.159[.]215\n104.21.62[.]131\n```"
}