Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Attackers are leveraging trusted Microsoft programs and encrypted network traffic, combined with social engineering via ClickFix, to establish persistence and prepare Windows systems for potential ransomware deployment.
Cybercriminals are employing a sophisticated multi-stage approach to compromise Windows systems, utilizing social engineering tactics and legitimate tools to establish a foothold for future ransomware attacks. A recent incident observed in late September involved attackers leveraging "ClickFix" techniques, which trick users into executing commands presented as system fixes or verification steps. This method, specifically the TerminalFix variant, directs users to Windows Terminal or PowerShell, creating an initial entry point without exploiting software vulnerabilities.
The infection chain begins with attackers distributing ZIP archives containing a signed Microsoft executable, a malicious DLL, and a batch script. When the legitimate Microsoft program is executed, it loads the adjacent malicious DLL through a technique known as DLL sideloading. The accompanying batch script ensures persistence by creating a registry startup entry and a scheduled task that runs hourly, allowing the malware to re-establish itself even after reboots.
To conceal its malicious payload, the downloader employs multiple layers of obfuscation. Encoded instructions are hidden within an added section of the malicious DLL, decoded using a dictionary of 260 random five-letter words. Further obfuscation is achieved through XOR decoding, and an embedded JPEG file acts as a decoy to mislead analysis. Once decoded, the downloader performs a unique step to interfere with endpoint monitoring: it restores parts of a Windows library from a clean disk copy before injecting its code into a new instance of its host program, then terminating the original process.
Once established, the malware uses a "dead-drop" command-and-control (C2) method, retrieving encoded server information from profiles on a legitimate public forum. This technique separates the C2 server list from the malware itself, making detection more challenging. The loader then communicates with its C2 server every five seconds, masquerading its traffic as legitimate Firefox activity.
The ultimate goal of this preparatory stage appears to be the deployment of a Python tunnel client. This client establishes an encrypted TLS connection on port 443, later switching to WebSocket communication. This tunnel provides attackers with a persistent, encrypted route back into the compromised environment, allowing them to relay data and execute commands remotely. This method is similar to other proxy attacks that aim to maintain access after initial infection.
Forescout researchers, who detailed these findings, also noted a separate delivery chain involving a modified Microsoft Teams MSI installer and PowerShell stages. While the specific payloads differed, this highlights the attackers' adaptability in using trusted software brands for malicious purposes. The investigation identified two loader families, Lorem Ipsum Loader and AxolotlLoader, with shared hosting links and registration patterns but distinct code and decoding methods, suggesting a possible evolutionary relationship.
Although the observed incident was contained before ransomware encryption occurred, the techniques employed—including ClickFix, DLL sideloading, dead-drop C2, and Python tunnels—are indicative of a ransomware operation. The activity has been linked to threat actors associated with Vice Society and Rhysida ransomware. Forescout recommends user training, monitoring for unusual PowerShell process chains, DLL loads outside of standard directories, and suspicious network traffic to defenders.
This incident underscores a growing trend where attackers are moving beyond simple exploits to build complex, multi-stage attack chains that leverage legitimate tools and obfuscation techniques to evade detection and establish persistent access, ultimately paving the way for disruptive ransomware deployment.