Supply chain engagement campaign: DLL ide-loading and backdoor in QuickFox exposes Chinese users outside China

Cybersecurity researchers have uncovered a supply chain engagement campaign against QuickFox, a VPN / network accelerator designed for Chinese users abroad, which according to Fortinet FortiGuard Labs has been active since at least August 2025. The vehicle was a broken Windows installer that contained an HTML file of the modified electron renderer to run two small JavaScript fragments, a legitimate one that imitated Firebase and another obfuscate that checked the victim's environment before downloading and installing a backdoor known as FDMTP.

From a technical point of view, the campaign took advantage of this ability of Electron to run web code on the installer and placed useful charges on a domain that imitated that of the supplier ("cdns3.51quickfox [.] cn" against "51quickfox [.] com"). The malicious code made computer fingerprints (operating system, AV, .NET, user, process list), sought the presence of specific processes - including development tools and cryptomoneda coins - and aborted if it detected software like Steam, indicating a deliberate attempt to filter unwanted machines. When the checks were completed, it downloaded a ZIP that, in two different generations, it used DLL side-rolling to run a DLL that installed the FDMTP backdoor or decipher a binary with the same functionality.

FDMTP is not new: it was documented as a secondary tool distributed by a download called PUBLOAD and its architecture allows the operator to request information from the computer, list processes and load additional modules from the control and control server, expanding its capabilities in real time. Fortinet noted tactical overlap with the actor known as Mustang Panda, famous for DLL side-rolling techniques, but did not issue a definitive attribution. The victim pattern suggests that the targets could be Chinese citizens outside China or professionals who usually interact with Chinese interlocutors, which is in line with a targeted and selective operation.

The practical implications are clear: applications for specific communities and tools that facilitate access to foreign networks can become vectors for espionage operations. The inclusion of checks to exclude machines with certain development tools or moneders indicates an interest in value objectives (researchers, engineers, employees of companies with access to sensitive data, or users of digital assets), and the use of techniques such as DLL side-loading complicates detection by static solutions or traditional signatures.

For users and administrators the first immediate recommendation is simple and urgent: update QuickFox to the version that eliminates the malicious component (according to the report, the released clean version was 3,59.6) and get the installer only from the official channels of the supplier, checking digital signature and sums where possible. Beyond that specific action, it is appropriate to add defensive controls: strengthen telemetry and endpoints detection (EDR), activate application control and white list blocking, monitor unusual parent / child processes and DLL loads, and apply egress rules that detect or block communications to domains that impersonate suppliers.

Organizations with users in these communities should review their third-party software management policies and the exposure of personal devices that access corporate resources. Implement separation between personal and working devices, avoid using unaudited tools to access corporate networks and require strong authentication and access through corporate bastions or VPNs reduce the risk that a committed installer will serve as a pivot to sensitive assets. Forensic analysis of suspicious equipment should include search for indicators such as injected DLL files, persistent entries in the Register, scheduled tasks and known C2 connections.

Finally, this incident recalls that the security of the supply chain is played both in the code and in the confidence of the ecosystem: suppliers must apply reproducible build practices, sign binaries and audit units, and users must demand transparency on changes in installers and distribution domains. To deepen the above technical concepts, it is useful to consult Electron's safety guides and the classification of techniques like DLL side-rolling in MITRE ATT & CK, which help you understand and mitigate these attack patterns. Fortinet FortiGuard Labs published the analysis that motivated this warning and for technical aspects of execution and code loading you can see the documentation of Electron at https: / / www.electronjs.org / docs / latest / tutorial / security and the technique description of DLL side-rolling in MITRE ATT & CK in https: / / attack.mitre.org / techniques / T1574 / 001 /.