Malware

FDMTP

FDMTP is a newly discovered hacking tool developed in .NET, used by Earth Preta. It functions as a simple malware downloader and is based on the TouchSocket framework over the Duplex Message Transport Protocol (DMTP). In one campaign, threat actors embedded FDMTP in the data section of a DLL. This allows it to be launched through DLL side-loading. The embedded network configurations are encoded and encrypted to enhance security and evade detection, utilizing Base64 and DES encryption methods. It has been observed to serve as a secondary control tool, often deployed by the PUBLOAD backdoor.

Indicators of Compromise 5

Domain cdns3[.]51quickfox[.]cn Filename Client.dll Filename firebase-analytics-compat.js Filename firebase-app-compat.js Filename update.bin

MITRE ATT&CK TTPs 8

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1053.005
Scheduled Task
Execution
 T1055
Process Injection
Defense Evasion
 T1059.007
JavaScript
Execution
 T1071
Application Layer Protocol
Command And Control
 T1071.001
Web Protocols
Command And Control
 T1112
Modify Registry
Defense Evasion
 T1204.002
Malicious File
Execution

Source Articles

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
A long-standing supply chain attack has affected QuickFox, a VPN and network acceleration tool, since at least August 2025. The malicious Windows installer, starting from version 3.0.51.0, delivers a backdoor called FDMTP via a trojanized Electron-based application. The attack uses a JavaScript loader that fingerprints the victim endpoint and downloads the payload from a malicious domain, cdns3.51quickfox[.]cn, which mimics the legitimate domain. The malware employs DLL side-loading to execute FDMTP, which communicates with a C2 server to exfiltrate system information and download additional plugins, targeting users such as Chinese expatriates and professionals interacting with Chinese speakers.
hacker-news ·8h ago