[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd2mhcFSNSFFJ6tZGL5IrXJxAgGigtUa0hYgwZTIfVVs":3},{"article":4,"iocs":56,"watch_terms":76,"solutions":77,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"aa0b811f-a042-4940-a6be-fddec2f6a33e","QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer","quickfox-supply-chain-attack-delivers-fdmtp-backdoor-via-trojanized-windows-inst-81a8a8","Cybersecurity researchers have disclosed what has been described as a \"long-standing supply chain attack\" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver FDMTP, a","A long-standing supply chain attack targeting QuickFox VPN users has been disclosed, delivering the FDMTP backdoor via a trojanized Windows installer. The attack, attributed to Chinese state-sponsored threat actor Mustang Panda, began in August 2025 and uses modified Electron renderer files to download and execute JavaScript loaders. The malware checks for specific applications and then downloads the FDMTP implant, with QuickFox releasing a patched version in August 2025.","QuickFox VPN installer trojanized to deliver FDMTP backdoor by Mustang Panda.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fquickfox-supply-chain-attack-delivers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiFQzlCdxoVUtdNgowwmPFaISlBF7Y2HsG1BQf3b-UJDQzRbPB249_W6rwU_-TSW1NES4OI-12R1z3tXQ-QlZv8cEaagpyLJVYz48Etb9W0MtuNp9BTL_13-5Wg95kz-Ey5iZ288mTkPt_5pbsxoh7Kv2KrmHqj_Tqb0KR9NSzz-jO2DuoTLthh6Dn3FUIh\u002Fs1600\u002Fquick.jpg","2026-08-05T05:47:19+00:00","2026-08-05T08:00:22.741592+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Mustang Panda","threat_actor",{"name":21,"type":22},"QuickFox","product",{"name":24,"type":22},"FDMTP",{"name":26,"type":27},"Fortinet FortiGuard Labs","vendor",{"name":29,"type":30},"VPN","technology",{"name":32,"type":30},"Electron","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64,66,70,73],{"type":58,"value":59,"context":60},"domain","cdns3.51quickfox.cn","Domain used to stage malicious JavaScript payloads and ZIP archives.",{"type":58,"value":62,"context":63},"51quickfox.com","Official QuickFox domain, potentially used for initial compromise or reconnaissance.",{"type":50,"value":24,"context":65},"Backdoor delivered by the QuickFox supply chain attack.",{"type":67,"value":68,"context":69},"mitre_attack","T1059.007","JavaScript execution for initial payload delivery.",{"type":67,"value":71,"context":72},"T1574.002","DLL side-loading for payload execution.",{"type":67,"value":74,"context":75},"T1071.001","Web protocols for C2 communication.",[26,21,24],{"controls":78,"vendors":165},[79,107,136],{"slug":80,"name":81,"problem":82,"products":83},"patch-management","Automated patch management","Known holes get closed in days, not months.",[84,92,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":80,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":137,"name":138,"problem":139,"products":140},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[141,149,157],{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":158,"vendor_name":159,"vendor_logo":160,"product_slug":161,"product_name":162,"url":163,"description":164},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[166],{"slug":167,"name":168,"logo_path":169,"roles":170},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[171],"reported_by",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":189},"trojanized-quickfox-vpn-installer-delivers-state-sponsored-backdoor","Trojanized QuickFox VPN Installer Delivers State-Sponsored Backdoor","The QuickFox supply chain attack demonstrates how threat actors can compromise trusted software distribution channels to deliver malware to unsuspecting users who believe they are installing legitimate software. Mustang Panda, a Chinese state-sponsored group, modified Electron renderer files within the Windows installer to silently download and execute the FDMTP backdoor — a technique that bypasses user suspicion because the compromise occurs within a trusted application bundle. This matters because VPN software, by its nature, is often granted broad network permissions, making it a high-value target for implanting persistent, stealthy access. The delay between the attack's onset (August 2025) and public disclosure underscores how supply chain compromises can persist undetected for extended periods, amplifying the blast radius across all users of the affected software.",[177,178,179,180,181,182,183,184,185,186,187,188],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management Practices","NIST CSF ID.SC-4: Suppliers and third-party partners are routinely assessed","NIST SI-7: Software, Firmware, and Information Integrity","NIST SR-11: Component Authenticity","NIST IR-5: Incident Monitoring","MITRE ATT&CK T1195.002: Supply Chain Compromise – Compromise Software Supply Chain","MITRE ATT&CK T1059.007: Command and Scripting Interpreter – JavaScript","ISO\u002FIEC 27036: Information Security for Supplier Relationships","ITIL: Change and Release Management (third-party software validation)",{}]