A Windows intrusion investigated in late September used a ClickFix lure, memory-resident malware and Python-based tunnels to build the kind of foothold commonly used before a ransomware deployment. Defenders interrupted the incident before files were encrypted, but researchers say the tools and techniques resembled activity previously associated with Vice Society, a group linked to Rhysida ransomware.

The investigation by Forescout examined a loader called Lorem Ipsum Loader alongside 39 samples of the related AxolotlLoader family. The analysis found a new installer-style delivery chain, overlapping command infrastructure and a layered approach designed to hide activity inside trusted Windows processes.

ClickFix turns the victim into the entry point

ClickFix attacks do not depend on exploiting a software vulnerability. They present fake verification steps, error messages or technical fixes that persuade a user to copy and run a command. A variation known as TerminalFix directs the victim toward Windows Terminal or PowerShell, effectively convincing the target to launch the attack.

In the observed chain, ZIP archives contained a legitimate signed Microsoft executable, a malicious dynamic-link library and a batch script. Running the trusted program caused it to load the nearby hostile library through DLL sideloading. Because the initial executable was validly signed, the sequence could appear less suspicious to users and some security controls.

The batch script established persistence through both a registry startup entry and a scheduled task that executed every hour. Multiple persistence paths increase the chance that the attack survives a reboot or the removal of a single component.

Layers of concealment protect the loader

The malicious DLL stored encoded instructions in an added section. Researchers found a dictionary of 260 random five-letter words used to decode part of the payload, followed by another XOR-based decoding layer. An embedded JPEG served as a decoy while the downloader prepared its code in memory.

The loader also restored portions of a Windows library from a clean copy on disk, behavior intended to interfere with endpoint-monitoring hooks. It then started another instance of its host application, injected code into that process and terminated the original. A mutex and unique marker prevented multiple copies from running at once.

These steps matter because each stage reduces the amount of obviously malicious code written to disk. Trusted binaries, process injection and in-memory execution can complicate detection when defenders rely mainly on filenames or static signatures.

Python creates an encrypted route inside

The campaign’s next stage installed a Python environment and tunnel components that could give operators a route back into the compromised network. Encrypted tunneling can hide command traffic inside connections that resemble ordinary web activity and can provide access to internal services not normally exposed to the internet.

That remote access is valuable to ransomware operators. It gives them time to explore the network, obtain higher privileges, locate backups and identify high-value systems before launching encryption. In this case, the attack was stopped before that final stage, so attribution to Vice Society or Rhysida remains an assessment based on similarities rather than confirmed responsibility.

What defenders should watch for

• Users launching copied PowerShell or terminal commands after web verification prompts.
• Signed applications loading unexpected DLL files from archive or user-writable folders.
• New hourly scheduled tasks and unusual registry startup entries.
• Python installations or tunnel processes appearing on systems that do not require them.
• Injected child processes and outbound encrypted connections to unfamiliar infrastructure.

Organizations can reduce the attack surface by training staff that CAPTCHA and support pages should never require pasted terminal commands. Application control can prevent unsigned libraries and scripts from running in temporary directories, while behavioral monitoring can connect the separate signs of sideloading, persistence and tunneling.

The incident demonstrates how ransomware preparation can look mundane in isolation. A copied command, a signed Microsoft binary and a Python process may each seem explainable. When they occur in sequence, they form a high-confidence warning that an intruder is building durable access and should be contained before the disruptive payload arrives.

Source: Cyber Security News.