Microsoft Fondue.exe Exploited for Malware Deployment

Cybersecurity researchers have identified a new attack strategy involving the misuse of a lesser-known Windows executable. Hackers are exploiting Fondue.exe, a genuine Microsoft utility, to covertly load a malicious control panel file named APPWIZ.cpl, thereby facilitating the stealthy installation of malware on victim systems.

Exploitation of Fondue.exe

This sophisticated method leverages a trusted system binary, making detection by conventional security software more challenging. The attack commences with the deployment of a deceptive MSI installer, masquerading as legitimate software, which is distributed via fraudulent websites mimicking authentic developer resources. Upon execution, this installer deposits several files into a concealed directory, including the legitimate Fondue.exe binary and a compromised version of APPWIZ.cpl, equipped with obfuscation mechanisms.

The attackers aim to render the procedure indistinguishable from regular system operations. Trend Micro’s report, shared with Cyber Security News (CSN), highlights an increasing trend among advanced threat groups to exploit legitimate Windows binaries. This tactic effectively circumvents security measures by hiding behind trusted processes.

Targets and Methodology

The threat actors behind this campaign, tracked by intelligence teams, are employing generative AI to expedite the development of attack tools, indicating a concerning advancement in their capabilities. The campaign primarily targets governmental bodies, military personnel, and professionals in drone manufacturing and engineering sectors.

Attackers have used fake Starlink registration services and drone pilot training applications to deceive victims into running the malicious installers. These carefully crafted decoys appear highly credible to their intended targets, posing significant risks in environments where operational precision is critical.

Technical Details and Defense Strategies

Fondue.exe, known as the ‘Features on Demand UX’ application, is exploited by placing a rogue APPWIZ.cpl file in the same directory, which diverts the system’s binary loading process. This malicious file is protected using UPX compression and Oreans Code Virtualizer, complicating reverse engineering efforts.

Once embedded, the malware establishes persistence by creating a scheduled task that mimics legitimate system activities. This task connects to the attackers’ command-and-control server, facilitating long-term espionage activities. Security experts recommend vigilant monitoring of Fondue.exe execution outside standard directories and deploying endpoint detection systems to flag suspicious DLL and CPL side-loading behaviors.

The use of AI in crafting malware signifies a shift in threat dynamics, reducing barriers for attackers to develop sophisticated implants. Organizations are advised to remain cautious of software installations from unofficial sources, even when they appear legitimate.

The ongoing exploitation of authentic Windows binaries for malicious purposes underscores the effectiveness of such tactics among advanced persistent threats. Security measures should prioritize behavioral indicators over file-level signatures to enhance detection capabilities.