Dragon Boss Solutions Supply Chain Attack Exposes 25,000+ Endpoints

Early on Sunday, 22 March 2025, what initially appeared to be routine adware suddenly escalated into a serious supply chain risk across managed environments.

Seemingly benign executables, signed by Dragon Boss Solutions LLC, were using a built-in update mechanism to hide a multi‑stage attack chain focused on systematically turning off endpoint security tools.

By abusing a trusted software update workflow and running with SYSTEM privileges, the operation quietly created an ideal staging ground for future ransomware, cryptomining, or data theft campaigns at scale.

Dragon Boss Solutions presents itself as a “search monetization” company, historically categorized as a PUP/adware vendor associated with browser hijacking and modified Chromium‑based builds.

In this campaign, signed binaries such as RaceCarTwo.exe and a cluster of pseudo‑randomly named installers (for example, WorldWideWeb.exe, WinDefenseThree.exe, ChromsteraUpdater.exe) deployed MSI packages and PowerShell payloads under familiar‑looking “Solutions” and “Workstation” directories in Program Files.

Behind that façade, the update chain dropped an AV‑killing PowerShell script, ClockRemoval.ps1, which methodically detects security products, kills their processes during boot, disables their services in the registry, and wipes related files and Run keys.

The script then hardens the compromised host against defenders, not attackers. It establishes WMI event subscriptions and multiple SYSTEM‑level scheduled tasks to re‑run removal routines at boot, logon, and every 30 minutes, ensuring any attempt to reinstall security tools is quickly reversed.

To complete the lockout, it injects a managed block of AV vendor domains into the hosts file and adds Windows Defender exclusions for both legitimate browser paths and attacker‑controlled staging folders, turning the machine into a long‑lived blind spot.

Huntress analysts found that key update domains hard‑coded into configuration files including worldwidewebframework3[.]com and chromsterabrowser[.]com were unregistered at the time of investigation.

A $10 Open Door in the Update Channel

The most critical discovery was not the payload itself, but the update infrastructure behind it. The PUP uses Advanced Installer’s update mechanism, configured to run silently, with PerMachine scope and non‑disableable auto‑checks, meaning it repeatedly polls remote servers for new MSI installers with elevated privileges and no user interaction.

In one variant, chromsterabrowser[.]com is set as the primary update URL, not just a fallback.

This turns the scenario into a classic update‑channel supply chain threat: any actor willing to spend roughly $10 to register the domain could instantly inherit the ability to push arbitrary MSI payloads to every affected host, with AV already disabled and the update client running as SYSTEM.

In a controlled lab, Huntress demonstrated that by mirroring Dragon Boss’ expected manifest and file naming, the updater would silently download and install an attacker‑supplied MSI with no prompts or UAC warnings.

25,000+ Endpoints Reaching for Instructions

To confirm real‑world exposure, Huntress pre‑emptively registered chromsterabrowser[.]com and worldwidewebframework3[.]com and pointed them to sinkhole infrastructure.

The Invoke-MbRemovalAvHostsBlock function writes these domains to the host’s file, redirecting them to 0.0.0.0. 

Within 24 hours, more than 23,500 unique IP addresses reached out for updates, representing over 25,000 compromised endpoints globally attempting to retrieve instructions from the unclaimed domain.

The bulk of observed traffic originated from the United States, France, Canada, the United Kingdom, and Germany, but infections spanned over 100 countries, underscoring the scale of distribution achieved by what began life as “just” adware.

Among these were several hundred high‑value environments, including universities, government entities, operational technology networks, schools, healthcare organizations, and Fortune‑level enterprises.

While that subset accounts for a small percentage of total infections, the combination of disabled AV, SYSTEM‑level update execution, and an easily hijackable domain translates into outsized risk: a single malicious update could have turned this monetization‑driven PUP network into a globally distributed access and ransomware foothold overnight.

This incident highlights how quickly “annoying” PUP detections can cross the line into genuine supply chain territory.

Signed adware, a trusted installer framework, and silent auto‑updates created the perfect cover for an AV killer, and a mismanaged domain configuration left the final stage payload control effectively up for sale.

Defenders should actively hunt for Dragon Boss Solutions signatures, the described WMI subscriptions and scheduled tasks, and suspicious browser binaries compiled with update‑disabling flags, rather than treating such alerts as low‑priority noise.

Ultimately, this campaign shows that the grey zone of PUPs can darken rapidly when monetization logic, privileged updaters, and sloppy domain hygiene collide.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.