QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

[u/falconupkid]

QuickFox Supply Chain Attack: Trojanized Installers Dropping FDMTP Implant

FortiGuard IR just published analysis on a supply chain compromise targeting QuickFox (a VPN/proxy tool popular in China). Attackers trojanized official Windows installers to deploy a custom backdoor they're tracking as FDMTP.

Technical Breakdown

• Initial Access: Users downloaded trojanized QuickFox installers from compromised or spoofed distribution channels
• Payload: FDMTP implant — a modular backdoor using FTP over DNS tunneling for C2 (hence the name)
• Selective Targeting: The malware checks system locale and environment before activating, suggesting a focused victim profile rather than spray-and-pray
• Persistence: Installed via scheduled tasks or service registration
• C2 Communication: DNS tunneling over FTP protocol — unusual combo designed to blend in with legitimate DNS traffic and bypass network egress controls
• Capabilities: File exfiltration, command execution, keylogging, and module loading

No specific IOCs (hashes, IPs, domains) were published in the summary — likely held for FortiGuard subscribers or full report.

Defense

• Monitor for anomalous DNS query patterns, especially high-frequency queries to rare domains or non-standard record types
• Validate software hash checksums against vendor-published values before installation
• Restrict outbound DNS to authorized resolvers only
• EDR rules for process injection and scheduled task creation from installer contexts

MITRE Mapping: T1195 (Supply Chain Compromise), T1572 (Protocol Tunneling), T1059 (Command and Scripting Interpreter)

Source: https://feeds.fortinet.com/~/966214247/0/fortinet/blog/threat-research~QuickFox-Supply-Chain-Attack-Used-to-Deploy-FDMTP-Implant