# When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk

Signed adware updater polled an unregistered domain, letting anyone who registered it push SYSTEM-level payloads to 23,565 infected hosts with AV already disabled.

- Payout: Real-world hack
- Severity: critical
- Program: Dragon Boss Solutions
- Credited: Huntress
- Disclosed: 2026-04-14
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/pups-grow-fangs
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs
- Tags: domain:desktop impact:mass-exploit impact:privesc impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:recon technique:source-review vuln:misconfiguration vuln:privilege-escalation vuln:rce

**Target:** Windows endpoint software update mechanism (Advanced Installer) with signed PUP executables
**Root cause:** The PUP's Advanced Installer update config pointed its primary update URL at an unregistered domain (chromsterabrowser[.]com), and the updater silently installs any MSI served there with SYSTEM privileges and no user interaction.
**Steps:**
1. Identify hosts with executables signed by 'Dragon Boss Solutions LLC' and read the updater .ini (e.g. `ChromsteraUpdater.ini`) to extract update URLs.
2. Note primary URL `chromsterabrowser[.]com` is unregistered; register it and point DNS to attacker server.
3. Serve an `updates.txt` manifest mirroring the legitimate format, pointing to a payload named like `ldk4945jfds.gif`.
4. Host a malicious MSI at that path over HTTPS with a trusted-CA cert (self-signed fails) and matching configured payload size.
5. Updater polls on schedule (CheckFrequency=1), downloads and silently installs MSI as SYSTEM with no UAC.
6. Payload executes (lab PoC: calc.exe; real chain: ClockRemoval.ps1 AV killer).
**How found:** Huntress triaged WMI persistence alerts named 'MbRemoval'/'MbSetup' and rapid scheduled-task creation, traced back to a signed Dragon Boss executable and Setup.msi, then read the leftover .ini update config and noticed the primary update domain was unregistered.
**Exploitation:** Attacker registers the dangling primary update domain, serves a signed-CA HTTPS manifest and MSI matching expected filename/size, and every infected host polling that domain silently installs the payload as SYSTEM with AV already disabled by prior ClockRemoval.ps1 stages.
**Escalation:** Pre-existing infection already disabled AV, added Defender exclusions for staging dirs (DGoogle, EMicrosoft, DDapps), and established WMI/scheduled-task persistence, so a single domain registration yields mass SYSTEM code execution across ~23,565 hosts including universities, OT utilities, and government networks.
**Insight:** When triaging PUP/adware, always read the updater's config file for update URLs and check registration status — a dangling primary update domain in signed auto-update software is a turnkey supply-chain RCE, and the fallback-vs-primary distinction determines whether blocking the live domain helps.