The Fox Tempest Question

A Chinese Loader, a Stealer with a Stolen Identity, and Eleven Days of Coincidence

Fox Tempest campaign overview graphic.

Credits: JAMESWT_WT (initial sample submission)

Abstract

This report documents a complex malware-signing cluster centered on two distinct binaries sharing a single build lineage but routed through two completely unrelated code-signing trust chains.

On 2026-05-11 and 2026-07-07, researcher JAMESWT_WT submitted a cluster of samples to MalwareBazaar bearing a now-revoked Certum Code Signing certificate issued to “Huizhou Ningda Times Supply Chain Co., Ltd.” — a registered but non-operational entity with no genuine commercial footprint, consistent with a shell identity created or co-opted for certificate procurement.

MalwareBazaar submission tagged Huizhou-Ningda-Times-Supply-Chain-Co-Ltd.

Revoked Certum code-signing certificate issued to Huizhou Ningda Times Supply Chain Co., Ltd.

The malware combines an active, persistent Telegram-based reverse shell with an opaque, client-side cryptographic device-fingerprinting routine hosted at idantre[.]com/index.html using a 32-bit FNV-1a non-cryptographic hash.

A second binary tied to the same campaign, an information stealer named AFP.exe, beacons to the same backend infrastructure but carries a signature issued via Microsoft’s “Trusted Signing” service under an individual identity-verification tier (“Benjamin Tillinger”). This signature was timestamped on 2026-05-08 — exactly 11 days prior to Microsoft’s historic public disclosure of Fox Tempest, a financially motivated Malware-Signing-as-a-Service (MSaaS) operation known for abusing this identical Microsoft verification tier via stolen identities.

Microsoft Trusted Signing certificate issued to the individual identity “Benjamin Tillinger,” timestamped 2026-05-08.

Static analysis confirms a matched code-level origin (shared PDB paths, falsified future-dated PE compilation timestamps, and hardcoded C2 configurations). This operation provides concrete evidence of a nation-state-adjacent actor (matching the TTPs of the Dragon Breath/APT-Q-27 cluster) actively sourcing disposable code-signing components from commercial underground MSaaS networks to achieve defense evasion and multi-tiered infrastructure resilience.

1. Sample & Signing-Chain Analysis

1.1 Overview

• Submission source: JAMESWT_WT — MalwareBazaar upload (2026-05-11 / 2026-07-07)
• MalwareBazaar tag: Huizhou-Ningda-Times-Supply-Chain-Co-Ltd
• Primary C2 domain: idantre[.]com (Age: ~3 months, GoDaddy, WHOIS redacted)
• Family association: Multiple samples tagged as Cobalt Strike / Infostealer loaders.

1.2 Loader — WindowsFormsApp1.exe (“Job Information.exe”)

• SHA-256: 22a3ed2d3721450f884f4c219e3afd7a36c571d65392534f38787fca605e328c
• Signing entity: Huizhou Ningda Times Supply Chain Co., Ltd. (CA: Certum | 🔴 Revoked)
• PDB path: C:\Users\Jack\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb
• Compilation timestamp: Falsified / future-dated (2084-12-11)

WindowsFormsApp1.exe loader — Certum signature and PDB metadata.

1.3 Stealer — AFP.exe

• SHA-256: 63a552f1683cdaf569b1d72c565524a3d783da996fa0d37076a6018c6a256e7f
• Signing entity: Benjamin Tillinger (CA: Microsoft Trusted Signing / Individual Tier)
• Signing date: 2026-05-08
• PDB path: C:\Users\Jack\source\repos\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\WindowsFormsApp1.pdb

AFP.exe stealer — Microsoft Trusted Signing signature details.

2. Technical Deep Dive: Inside the Dual-Channel C2 Pipeline

Decompilation and behavioral tracking of WindowsFormsApp1.exe break the traditional “simple loader” assumption. The binary acts as a fully functional, highly evasive execution engine split across two distinct channels.

                [ Executable: WindowsFormsApp1.exe ]
                                 │
       ┌─────────────────────────┴─────────────────────────┐
       ▼ (Initial Execution)                               ▼ (Persistent Loop)
[ Channel A: Validation ]                        [ Channel B: Command Core ]
Invisible WebBrowser Control                     Telegram Bot HTTP Polling
URL: idantre[.]com/index.html                    Endpoint: api.telegram.org
Logic: FNV-1a Client-Side Hash                   Function: Remote Code Execution (RCE)

2.1 Channel A: Client-Side C2 Fingerprinting (idantre[.]com)

Upon initial execution, the application initializes an implicit Form1 routine, creating an invisible, maximized native Windows WebBrowser control. To evade user inspection on the taskbar, the window title is populated with an invisible Unicode Zero-Width Non-Joiner character (\u200c).

The control is hardcoded to navigate to:

https://idantre[.]com/index.html

Analysis of the JavaScript hosted on this landing page reveals a deterministic fingerprinting engine. It queries api.ipify.org to retrieve the target’s public IP address, combines it with the host’s navigator.userAgent, and hashes the payload using a 32-bit FNV-1a non-cryptographic hash routine:

var raw = (ip || '') + '|' + ua;
var seed = hashStr(raw); // Seeded with 0x811c9dc5, multiplier 0x01000193
var num = genFromSeed(seed); // Processes via Linear Congruential Generator (LCG)

The LCG utilizes classic numerical constants (a = 1664525, c = 1013904223) to project a 5-digit tracking-number and an 8-character hexadecimal Session ID back to the UI. Because the web browser engine writes its operations into local system directories, behavioral analysis engines catch index.html being dropped into the host’s temporary internet cache files.

idantre[.]com client-side fingerprinting output showing the generated tracking number and session ID.

Purpose

• Sandbox evasion: If automated sandboxes or security tools fuzz or query the idantre[.]com panel without passing a mathematically valid Session ID/Tracking Number tied to an open browser context, the backend drops the request, remaining dark to analysts.
• Centralized tracking: It gives every infected machine a unique “serial number” before alerting the primary operators, preventing infrastructure clogging.

idantre[.]com validation panel behavior.

2.2 Channel B: Active Telegram Reverse Shell (Program.r)

Once local persistence is checked, the application enters an aggressive, infinite loop (for (;;)) within the Program.r() method, turning the loader into a continuous Remote Access Trojan (RAT).

The malware uses long-polling HTTP GET requests (getUpdates?timeout=30&offset=) to listen to an embedded, threat-actor-controlled Telegram Bot:

• Active token: 7640131659:AAHLHErB4Y53tqTB6COKUFUA_bdIzve56-8

When an operator posts a command inside the Telegram chat, the malware reads the text object, parses the parameters, and feeds the string directly into a hidden operating system shell execution method (Program.d()):

Process process = new Process();
process.StartInfo.FileName = fileName; // Incoming Telegram message string
process.StartInfo.RedirectStandardOutput = true;
process.StartInfo.RedirectStandardError = true;
process.Start();

The captured execution outputs (stdout or stderr) are sucked back into memory and exfiltrated straight back to the threat actor via the Telegram sendMessage API endpoint.

This is how subsequent payloads (like the Microsoft-signed stealer AFP.exe) are dropped onto the host. The operators manually issue PowerShell download cradles via the Telegram interface to drop and execute files.

2.3 Persistence Mechanism

The binary copies itself into a deeply hidden folder inside the user profile workspace:

%USERPROFILE%\AppData\Local\Microsoft\Windows\0\

It establishes tactical persistence by registering a native Windows Scheduled Task configured to fire at an extreme, high-frequency interval:

• Task name: User_Feed_Synchronization-{53CB5C5D-3094-4B43-9376-[RANDOM_NUM]}
• Argument logic: /create /tn "[Task_Name]" /tr "[Malware_Path]" /sc minute /mo 1
• Execution rate: Every 1 minute, indefinitely.

User_Feed_Synchronization scheduled task configured to run every minute.

3. Build Lineage — Shared-Origin Evidence

A static comparative assessment of both binaries establishes identical origin, proving a single developer workspace created both the loader and the stealer:

4. Entity Analysis & The Fox Tempest Connection

4.1 Huizhou Ningda Times Supply Chain Co., Ltd.

Comprehensive verification sweeps across major Chinese enterprise tracking platforms confirm the entity is registered but shows no genuine operational footprint:

• Registries queried: Qichacha, Tianyancha, Aiqicha, National Enterprise Credit System
• B2B platforms checked: Alibaba, Made-in-China
• Finding: Registration record present, but no commercial or operational trace under any transliteration or legal spelling

Qichacha corporate registry search result for Huizhou Ningda (translated).

Huizhou Ningda Times Supply Chain Co., Ltd. (惠州市宁达时代供应链有限公司; USCC: 91441322MADNB3TJXX) is a Chinese limited liability company registered on 28 June 2024 in Boluo County, Huizhou, Guangdong Province, with a registered capital of only ¥100,000 RMB (~US$14,000). The entity lists 张建东 (Zhang Jiandong) as its sole legal representative, sole verified principal, and suspected actual controller — a natural person with no other registered business interests and no public profile. Its declared business scope is broad and generic, spanning supply chain management, e-commerce, electronics wholesale, import/export, and general merchandise, with no evidence of genuine commercial operations: no corporate website, no press or industry footprint, no litigation history, no tender activity, and only a mobile phone number and free QQ email address on file. The company’s profile — minimum-tier capitalisation, recent registration, single-individual ownership, generic multi-purpose business scope, and complete absence of operational indicators — is highly consistent with a shell entity established to satisfy Certificate Authority vetting requirements for the procurement of legitimate code-signing certificates, and the named legal representative should not be assumed to be the true operator.

Registered address — Shangde Science & Technology Park, No. 13 Jinlong Avenue, Boluo County.

The registered address corresponds to Shangde Science & Technology Park (尚德科技园) at No. 13 Jinlong Avenue, Boluo County — a real light-industrial park adjacent to the G25 Huihe Expressway whose other tenants are almost exclusively small physical-goods manufacturers in food processing, abrasives, refrigeration, steel, and construction materials. The subject entity, which lists no manufacturing activity and shows no operational footprint, is anomalous within this tenant profile.

This indicates a shell registration — established or co-opted specifically to satisfy Certum’s validation gates rather than to conduct genuine business. This identical TTP was previously observed with Zhengzhou 403 Network Technology Co., Ltd., an identity explicitly tied to the Dragon Breath (APT-Q-27) operational cluster.

4.2 The Fox Tempest Sourcing Correlation

The information stealer (AFP.exe) was signed on 2026-05-08 via Microsoft’s Trusted Signing Individual verification tier under the identity “Benjamin Tillinger.”

This timestamp occurs exactly 11 days prior to Microsoft’s industry-wide disclosure (May 19, 2026) of Fox Tempest — a prolific, financially motivated Malware-Signing-as-a-Service (MSaaS) broker that systematically exploited Microsoft’s lighter identity verification tier using compromised US/Canadian credentials to pump out over 1,000 fraudulent certificates to ransomware and stealer actors.

5. Threat Architecture & Sourcing Logic

The core design of this campaign clarifies the economic relationship between nation-state-adjacent operations (Dragon Breath pattern) and transactional cybercriminal utility networks (Fox Tempest):

1. OPSEC isolation: The active command infrastructure (Telegram RAT) is highly visible and prone to security flagging. By wrapping it inside a pristine Microsoft Trusted Signing certificate issued via Fox Tempest networks, the operators shield the binary from initial SmartScreen and heuristic blocklists, buying the loader enough time to establish its high-frequency persistence task.
2. Infrastructure segregation: The operators isolate their proprietary tracking infrastructure (idantre[.]com and the FNV-1a validation logic) from their communication pipes. If Microsoft revokes the “Benjamin Tillinger” certificate or Telegram shuts down the active bot token, the core operation remains unharmed. The persistent, local scheduled tasks will simply continue checking into idantre[.]com/index.html to wait for a new payload configuration.

6. Attribution Assessment & Confidence Table

6.1 Attribution Profile

• Assessment: 🟡 MEDIUM CONFIDENCE — Dragon Breath / APT-Q-27 Ecosystem Pattern
• Justification: The combination of an unverified Chinese supply-chain shell identity, revoked third-party certificates (Certum), Cobalt Strike-oriented loaders, and specific anti-analysis staging architectures aligns tightly with documented Dragon Breath behaviors. Cross-ecosystem infrastructure acquisition (purchasing commercial code-signing access from brokers like Fox Tempest) is consistent with advanced operators utilizing underground markets for commodity execution needs.

6.2 Confidence Matrix

7. MITRE ATT&CK Mapping

8. Indicators of Compromise (IOCs)

8.1 File Hashes (SHA-256)

• 22a3ed2d3721450f884f4c219e3afd7a36c571d65392534f38787fca605e328c (Loader / RAT)
• 63a552f1683cdaf569b1d72c565524a3d783da996fa0d37076a6018c6a256e7f (Information Stealer)

8.2 Certificate & Identity Indicators

• Signer name: Huizhou Ningda Times Supply Chain Co., Ltd. (CA: Certum)
• Signer identity: Benjamin Tillinger (CA: Microsoft Trusted Signing)

8.3 Network & Infrastructure Context

• idantre[.]com (Core validation domain)
• https://api.telegram.org/bot7640131659:AAHLHErB4Y53tqTB6COKUFUA_bdIzve56-8/ (Active C2 channel)

9. Defensive Recommendations

1. Block by hash & domain: Deploy immediate blocks for the core hashes and the validation host idantre[.]com at perimeter firewalls, proxies, and secure email gateways.
2. Certificate-level hunting: Create proactive detection rules flagging any active binary signed by Huizhou Ningda Times Supply Chain Co., Ltd. or carrying individual-tier signatures issued under the identity Benjamin Tillinger.
3. Telegram bot takedown: Submit immediate threat telemetry containing Bot Token 7640131659:AAHLHErB4Y53tqTB6COKUFUA_bdIzve56-8 to Telegram’s abuse operations group to terminate the active reverse shell.
4. Scheduled task monitoring: Audit enterprise endpoint spaces for any irregular Scheduled Tasks matching high-frequency parameters (e.g., executing every 1 minute) using names that mimic core synchronization tasks like User_Feed_Synchronization.