Poisoned Windows software updates deliver a Yunnan-targeted implant
QiAnXin’s RedDrip team reports six Chinese software update channels hijacked. An analyzed Windows implant checks for Yunnan and uses DNS-over-HTTPS TXT records to find its command servers. The report publishes indicators and omits product names and victim counts.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Windows systems that ran tampered updates or installers from the campaign, especially endpoints in Yunnan.
- software updates · supply chain · Windows · Yunnan
- In the wild
- Yes
- RedDrip observed hijacked update channels and analyzed the delivered malware.
What happened
The research describes update clients that accepted unencrypted manifests containing both the download link and its MD5 digest. Anyone able to alter that response could replace both values and advertise a newer version. The affected update flow also lacked publisher-signature verification. The report does not establish how each update channel was first hijacked.
The researchers analyzed tampered installers, including one that used a signed AMD executable to load an adjacent malicious DLL. A later Windows payload can load .NET plug-ins in memory and persist through a scheduled task. One analyzed implant checks the endpoint’s geolocation for Yunnan. The researchers also linked a modified system tool and a trojanized messaging client using shared infrastructure and a named-pipe pattern. They do not name the affected products, quantify infections or establish which plug-ins ran on victim systems.
Crime-scene timeline
Nov 6, 2026
Researchers disclose the update hijacks and campaign indicators
The report documents malicious installers, sideloading, persistence and command-server discovery.
~Late Oct 2026
RedDrip starts tracking the activity in late October
The report gives only an approximate observation date.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- QiAnXin RedDrip technical analysis as published on CTF导航PrimaryDescribes six observed update-channel hijacks, sample behavior, geography checks, persistence and detailed indicators. The public page marks November 6 as the publication date.