TerminalFix Campaign Hides Malware in PNG Steganography
The TerminalFix campaign is using PNG steganography to embed malicious Windows executables and DLLs within image files, overwriting original content.
A sophisticated malware campaign dubbed "TerminalFix" has been observed employing an unusual technique to conceal its malicious payloads: PNG steganography. Researchers have detailed how threat actors embed Windows executables and DLLs directly within the pixel data of PNG image files, effectively overwriting the original visual content.
Analysis of the campaign's methods reveals a deliberate approach to manipulating PNG file structures. Threat actors are not merely appending data; they are embedding executable code within the image's IDAT chunks, which normally contain the compressed pixel data. This technique requires a deep understanding of the PNG format, including specific filter types used to encode scanlines, to ensure the embedded data can be later extracted and executed.
One of the primary methods involves hiding a Portable Executable (PE) file, such as a sideloading executable, within the image's pixel data. By leveraging the PNG filter types and the RGBA color model, the attackers can transform the pixel data into a representation of the executable. The first eight bytes of the extracted raw bitmap data are then used to determine the exact length of the embedded PE file, allowing for precise carving of the malicious payload.
In several instances, the embedded PE file was identified as LockScreenContentServer.exe, a legitimate Microsoft executable known to be abused for sideloading. This allows the attackers to leverage a trusted component to load their malicious code, further evading detection. The campaign also utilizes other PNG files to store malicious DLLs, often splitting the payload into two parts across different images.
Unlike typical steganographic methods that might subtly alter least significant bits to preserve the original image, the TerminalFix campaign appears to overwrite all available pixel data. This means that when these PNG files are rendered, they do not display the original image but rather a corrupted or nonsensical visual representation, indicating that the image itself has been sacrificed to carry the malware.
The campaign's reliance on steganography presents a unique challenge for traditional security solutions. Antivirus software and network intrusion detection systems may struggle to identify these files as malicious if they are not specifically programmed to detect embedded executables within image data. The use of valid PNG structures and filters further complicates automated detection.
The TerminalFix campaign highlights a growing trend of threat actors exploring novel and complex methods to obfuscate their malware and bypass security controls. By embedding payloads within seemingly innocuous image files, attackers can increase the likelihood of initial compromise and maintain persistence on victim systems.