Hackers Use ClickFix and Python Tunnels to Prepare Windows Systems for Ransomware
Attackers use social engineering tricks to install hidden loaders on Windows devices, creating access points that facilitate future ransomware deployment.
Key points
- Forescout researchers identified Lorem Ipsum Loader and AxolotlLoader in late September incidents targeting Windows systems.
- Attackers employ ClickFix social engineering to trick users into running commands that install malware via trusted Microsoft programs.
- The malware uses DLL sideloading, encoded payloads, and dead-drop command servers to evade detection and maintain persistence.
Researchers from Forescout reported on October 14 that hackers are using ClickFix social engineering tactics to install malware loaders on Windows systems. These attacks create hidden access points that could support subsequent ransomware deployments, according to Cyber Security News. The investigation highlights a shift toward preparatory infrastructure rather than immediate encryption.
A specific incident in late September demonstrated how a single user command can trigger an infection chain involving trusted Microsoft software. The attack was halted before ransomware affected the systems, but the tools matched activity linked to the Vice Society cybercrime group. This group is associated with Rhysida ransomware, suggesting a likely criminal objective, though no encryption occurred in this case.
Technical Analysis of the Attack Chain
Forescout examined five samples of Lorem Ipsum Loader and 39 samples of AxolotlLoader to understand the delivery method. The attackers used ZIP archives containing a signed Microsoft executable, a malicious DLL, and a batch script. When users run the trusted program, it loads the malicious library through a technique known as DLL sideloading.
The malicious DLL contained an additional section with encoded instructions. A dictionary of 260 random five-letter words helped decode the hidden payload, while another layer used XOR decoding. An embedded JPEG file acted as a decoy to distract analysts. These steps concealed the downloader until its code executed in memory.
Persistence and Command Control Mechanisms
The batch script created a registry startup entry and a scheduled task that ran every hour to ensure the malware remained active. After loading, the malware restored parts of a Windows library from a clean disk copy. This step was intended to interfere with endpoint monitoring tools and hide the infection from security software.
The loader launched another copy of its host program, injected code into that process, and terminated the original process. A unique marker and mutex prevented duplicate instances from running simultaneously. To locate command servers, the malware read encoded information from profiles on a legitimate public forum. This dead-drop method separated the server list from the malware itself.
Impact on Security Operations
This attack vector relies on user interaction rather than exploiting a software vulnerability. ClickFix, including its TerminalFix variant, directs users to Windows Terminal or PowerShell by presenting commands as verification steps or fixes. Earlier reporting noted that fake Cloudflare CAPTCHA prompts use similar approaches to create reverse tunnels into corporate networks.
The use of trusted Microsoft programs and encrypted network traffic makes detection difficult for standard security tools. The shared command traffic between Lorem Ipsum and AxolotlLoader suggests a coordinated effort or shared infrastructure among threat actors. Security teams must monitor for unusual process behavior and unauthorized registry changes.
What should you do?
Organizations should review their endpoint detection logs for signs of DLL sideloading and unusual process injection. Monitor for scheduled tasks that run at irregular intervals or from unexpected locations. Check for new registry entries that may indicate persistence mechanisms. Watch for connections to known public forums that could serve as dead-drop sites for command and control traffic.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Forescout
- Monitor endpoint logs for processes loading unexpected DLLs or injecting code into legitimate Microsoft applications.
- Audit scheduled tasks and registry startup entries for new or modified items that run at regular intervals.
- Inspect network traffic for connections to public forums or unusual domains that may serve as dead-drop sites.
- Train users to recognize ClickFix social engineering tactics and verify commands before executing them in terminal windows.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is ClickFix and how do attackers use it?
ClickFix is a social engineering tactic that tricks users into running commands presented as fixes or verification steps, allowing attackers to install malware.
Which malware loaders were identified in this investigation?
Forescout researchers identified Lorem Ipsum Loader and AxolotlLoader, which use similar delivery methods and command traffic patterns.
Did this attack result in ransomware encryption?
No, the attack was stopped before ransomware reached the affected systems, but the tools matched those used by the Vice Society group.
