Plan
active
Fake Software Installers Disable Windows Update and Weaken Defender
- Engineer — Learn: Campaign relies on social engineering (users fetching pirated/fake installers) rather than exploitable vulnerabilities in deployed software. No KEV, PoC, or EPSS signals; primary defense is enforcing managed software distribution and allowlisting, not an emergency patch.
- SOC/IR — Plan: The confirmed TTPs — disabling Windows Update and tampering with Defender — are detectable via EDR telemetry and SIEM. Build or tune detections for Windows Update service disablement and Defender policy modification events, and prioritize coverage for endpoints associated with China-based operations if applicable.
- Leader — Learn: Campaign targets China-based operations of multinationals specifically; leaders with that geographic footprint should note the elevated risk, but no named vendor breach or regulatory trigger warrants immediate action. Useful context for regional risk posture discussions.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.