Critical Microsoft Fondue.exe flaw lets attackers execute malware

Key Takeaways

• A sophisticated attack campaign is exploiting Fondue.exe, a legitimate Windows utility, for malicious side-loading of malware.
• The campaign primarily targets government entities, military personnel, and individuals in drone manufacturing, using deceptive lures like fake Starlink services and drone pilot training apps.
• Attackers leverage a multi-stage infection chain to deliver a Sliver post-exploitation framework and, in some cases, an AI-generated SoullessRAT.
• The technique relies on trusted system binaries, making detection difficult for conventional security solutions.
• Organizations are urged to monitor for unusual Fondue.exe execution and avoid software from unverified sources.

A new, highly targeted attack campaign has brought the seldom-examined Windows executable, Fondue.exe, under scrutiny, revealing its active exploitation in sophisticated side-loading operations. Cybersecurity researchers at BI.ZONE have detailed how threat actors are maliciously leveraging this legitimate Microsoft utility to load a rogue control panel file, APPWIZ.cpl, thereby silently deploying dangerous malware onto victim systems.

This tactic is particularly insidious because it harnesses a trusted, built-in system binary, allowing attackers to evade detection by many conventional security measures. By masquerading malicious activity within legitimate processes, the threat actors significantly complicate efforts to identify and neutralize their presence.

The attack sequence typically initiates with a malicious MSI installer. This installer is often disguised as legitimate software, distributed through deceptive websites that mimic authentic developer tools. Once executed by an unsuspecting user, the installer quietly drops several files into a hidden directory on the compromised machine. These files include a legitimate copy of Fondue.exe and a specially crafted, obfuscated version of APPWIZ.cpl, designed to appear as normal system components.

According to a report by Trend Micro, the abuse of legitimate Windows binaries is an increasingly common and effective strategy employed by advanced threat groups. This technique enables attackers to bypass security controls by operating under the guise of trusted processes, a pattern evident in the Fondue.exe campaign. Furthermore, the specific group behind this operation has reportedly used generative AI to accelerate the development of their attack tools, signaling a concerning advancement in adversary capabilities.

The campaign’s primary targets include government organizations, military personnel, and individuals involved in drone manufacturing and engineering. Attackers employ highly effective social engineering lures, such as fake Starlink device registration services and drone pilot training applications, to trick victims into executing the malicious installers. These decoys are meticulously designed to appear credible to their intended audience, posing a significant risk in sensitive operational environments.

Upon successful infiltration, the malware establishes persistence, communicates with attacker-controlled command-and-control (C2) servers, and positions itself for long-term espionage. The threat actors demonstrate a deep understanding of their targets, crafting convincing fake applications that align closely with the tools and workflows commonly used by their victims.

How Fondue.exe Is Abused to Side-Load Malicious Code

Fondue.exe, officially known as the “Features on Demand UX” application (version 10.0.19041.1), is a legitimate Windows system utility responsible for enabling or disabling optional operating system components. Attackers exploit a specific behavior of Fondue.exe: when it executes, it first searches for APPWIZ.cpl in its local directory before querying standard Windows system paths. By placing a malicious copy of APPWIZ.cpl within the same hidden folder as Fondue.exe, attackers force the trusted binary to load their rogue file instead of the legitimate one.

The malicious APPWIZ.cpl file is heavily protected using UPX compression and further obfuscated with Oreans Code Virtualizer, techniques commonly employed to hinder reverse engineering efforts. Once loaded into the memory space of Fondue.exe, this rogue control panel applet deploys a Sliver post-exploitation framework implant. Sliver, an open-source adversary simulation tool, provides attackers with a robust foothold on the infected machine, facilitating remote command execution and lateral movement within compromised networks.

To ensure persistence, the malicious applet creates a scheduled task in Windows Task Scheduler, configured to run every minute. This task is deliberately named to blend with legitimate Windows update activities, such as MicrosoftEdgeUpdateTaskMachineUA{GUID}, making it difficult to spot during routine system audits. The implant communicates with the attacker’s C2 server at curtainbeatdisturbance[.]com and creates a mutex named MediumTurquoiseBeige to prevent multiple instances from running on the same machine.

Multi-Stage Delivery and Espionage Objectives

The malware delivery process is characterized by its multi-staged and carefully layered nature. The initial MSI installer drops a PowerShell script, a VBS helper file, and a .NET loader. These components work in concert to download and execute the next-stage payload without triggering immediate alerts. An inner Inno Setup installer, named testexe.exe, is responsible for unpacking the final components into a hidden directory under %PROGRAMDATA%, where both Fondue.exe and the malicious APPWIZ.cpl are covertly placed.

In addition to the Fondue.exe-based attack, the same threat cluster has also deployed a separate JavaScript-based remote access trojan (RAT) named SoullessRAT against other targets. SoullessRAT is reportedly generated using AI and offers extensive espionage capabilities, including remote command execution, file uploads to the attacker’s server, screenshot capture, and system information harvesting. The emergence of AI-generated malware code suggests a significant reduction in the barrier to entry for creating custom, capable implants for threat actors.

Threat intelligence researchers recommend that organizations actively monitor for any unexpected execution of Fondue.exe originating from non-standard directories, particularly outside of C:WindowsSystem32. Implementing endpoint detection that specifically flags DLL and CPL side-loading behavior, coupled with alerts for new scheduled tasks mimicking Microsoft Edge or Microsoft Office naming conventions, can significantly enhance early threat detection. Furthermore, users and administrators are strongly advised to refrain from executing software installers obtained from unofficial sources, regardless of their apparent credibility.

The persistent abuse of legitimate Windows binaries for DLL and CPL side-loading remains a highly effective technique for advanced persistent threat actors. Therefore, security defenses should prioritize behavioral indicators over static file-level signatures for more robust protection.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Monitor Fondue.exe Execution: Implement robust endpoint detection and response (EDR) solutions to monitor for any unusual execution of Fondue.exe, particularly when it originates from non-standard directories (i.e., not C:WindowsSystem32).
• Detect DLL/CPL Side-Loading: Configure security tools to detect and alert on dynamic link library (DLL) and control panel applet (CPL) side-loading behaviors, which are key indicators of this attack.
• Scrutinize Scheduled Tasks: Pay close attention to newly created scheduled tasks, especially those attempting to mimic legitimate Windows update activities or using common application names like Microsoft Edge or Microsoft Office.
• Exercise Caution with Software Downloads: Educate users and enforce policies to avoid downloading and running software installers from unverified or unofficial sources, even if they appear legitimate.
• Prioritize Behavioral Detections: Focus security investments on solutions that offer behavioral analysis capabilities rather than relying solely on file-level signatures, as this attack leverages trusted binaries.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.