TerminalFix and Lorem Ipsum Loader enable covert tunneling

Immediate Actions

Key Takeaways

• TerminalFix lures instruct victims to open Windows Terminal instead of using the Run dialog
• Lorem Ipsum Loader maps English words to hex byte values to reconstruct shellcode at runtime
• Python tunneling implant uses encrypted WebSocket with per-victim UUID identification
• 19 DLL sideload pairings observed across both campaign phases from March to September
• Campaign shifted from signed MSI installers to TerminalFix after Microsoft certificate takedown

Attack Chain

1. Initial Access: TerminalFix lure tricks user into pasting PowerShell command via Windows Terminal
2. Execution: PowerShell downloads ZIP containing legitimate exe, malicious DLL, and batch script
3. Persistence: Batch script installs auto-run registry entries and scheduled tasks masquerading as Microsoft components
4. Defense Evasion: Legitimate executable sideloads malicious DLL containing Lorem Ipsum Loader shellcode stored as English words
5. C2: Loader resolves C2 servers via letsdiskuss.com profile, communicates using steganographic JPEG images over HTTP POST
6. Lateral Movement: Python WebSocket tunneling implant in Users\Public\indigo relays attacker traffic through compromised host

Affected Systems

• Windows endpoints with Windows Terminal installed
• Microsoft Teams users targeted via trojanized MSI installers
• Active Directory environments targeted for reconnaissance

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Sysmon Event ID 7 (Image Load)
• Sysmon Event ID 1 (Process Creation)
• Sysmon Event ID 11 (File Creation)
• PowerShell Script Block Logging
• Windows Registry Auditing
• Network proxy or firewall logs

Key Behavioral Indicators

• Python runtime extracted to Users\Public\indigo directory
• LockScreenContentServer.exe executing outside expected Windows paths
• Scheduled tasks with names mimicking Microsoft or update components
• PowerShell downloading ZIP archives and executing batch scripts
• Network connections to letsdiskuss.com user profiles
• Batch files executing alongside legitimate Windows executables in temp directories

Control Gaps

• Signature-based AV cannot detect word-encoded shellcode in memory
• Network DLP may not flag steganographic JPEG C2 traffic
• DLL sideloading via legitimate signed binaries bypasses application whitelisting
• WebSocket tunneling through compromised host evades egress firewall rules

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Restrict outbound WebSocket connections from non-server endpoints
• Block egress traffic to letsdiskuss.com at the proxy or firewall
• Monitor HTTP POST uploads containing JPEG files to unknown destinations
• Enable DLL load order monitoring for listed sideload target executables

User Protection

• Deploy EDR rules targeting the 19 documented DLL sideload pairings
• Restrict execution of batch files from user-writable directories
• Alert on PowerShell commands initiated via Windows Terminal paste events
• Block downloads of ZIP archives from untrusted domains via Terminal

Security Awareness

• Train employees to recognize ClickFix and TerminalFix verification prompts
• Warn staff that legitimate CAPTCHA pages never ask users to open Terminal or paste commands

MITRE ATT&CK Mapping

Plain-Language Summary

Attackers use fake verification prompts that trick people into running malicious commands through Windows Terminal. Once activated, the malware hides inside legitimate-looking Windows programs and establishes a hidden tunnel into the victim's network. The same criminal group behind Vice Society and Rhysida ransomware is suspected. Organizations should train staff to recognize these fake prompts and monitor for unusual Python activity in the Users\Public folder.

Additional IOCs

• File Paths:
  • Users\Public\indigo - Directory where Python runtime and tunneling implant are deployed
• Command Lines:
  • Purpose: Download and execute ZIP archive containing loader payload | Tools: powershell.exe | Stage: Initial Access | powershell -c
• Other:
  • slc.dll - Malicious DLL sideloaded by changepk.exe
  • faultrep.dll - Malicious DLL sideloaded by changepk.exe, werfaultsecure.exe, ResilientStorageCoordinator.exe
  • sppcext.dll - Malicious DLL sideloaded by changepk.exe
  • sspicli.dll - Malicious DLL sideloaded by embeddedapplauncher.exe, wuauclt.exe
  • secur32.dll - Malicious DLL sideloaded by embeddedapplauncher.exe
  • certenroll.dll - Malicious DLL sideloaded by certenrollctrl.exe
  • vdsutil.dll - Malicious DLL sideloaded by vdsldr.exe
  • cpulib.dll - Malicious DLL sideloaded by bin.exe
  • duser.dll - Malicious DLL sideloaded by sessionmsg.exe
  • mscoree.dll - Malicious DLL sideloaded by net runtime optimization service.exe
  • msvcp140.dll - Malicious DLL sideloaded by Microsoft Edge Updates Helper.exe and Microsoft Teams Revo Helper.exe