12 minhigh
TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog
The TerminalFix campaign is a ClickFix variant that uses compromised websites displaying fake Cloudflare CAPTCHA overlays to trick users into pasting malicious PowerShell commands into Windows Terminal. The attack chain progresses through DLL sideloading via a legitimate signed binary (LockScreenContentServer.exe loading dui70.dll), steganographic payload extraction from PNG images, dual persistence via registry Run keys and scheduled tasks, extensive Active Directory reconnaissance, and deployment of a custom Python-based reverse tunnel implant communicating over TLS WebSocket to gitnow[.]dev:443. The reverse tunnel provides the attacker with SOCKS5-style TCP proxy access through the compromised host, enabling lateral movement and potential follow-on activity such as privilege escalation, data exfiltration, and ransomware deployment.
Sens:■ Immediate
Showing defanged values
- domainbestsocialmedianewspapper[.]comAttacker-controlled domain used for hosting steganographic PNG images containing embedded executable and DLL payloads.
- domaingitnow[.]devC2 server for the custom Python-based reverse tunnel implant; implant connects over TLS port 443 and upgrades to WebSocket at /tunnel endpoint.
- domainofflineupdater[.]comFailover domain for steganographic image hosting and payload delivery, used as a backup when the primary content domain is unavailable.
- filenameclient.pyCustom Python-based reverse tunnel implant script that establishes a WebSocket tunnel over TLS to the C2 server, providing SOCKS5-style TCP proxy access.
- filenameC:\ProgramData\5da97240b3fd0f5bPayload directory used for persistence; hidden with attrib +h +s to reduce forensic visibility.
- filenameC:\ProgramData\f47f2a8c21c9df4eInitial extraction directory for the downloaded ZIP archive containing the sideloading payload kit.
- filenamedui70.dllMalicious DLL masquerading as the Windows DirectUI Engine, sideloaded by LockScreenContentServer.exe to execute second-stage PowerShell payloads.
- filenameLockScreenContentServer.exeLegitimate signed Windows binary abused as a DLL sideloading host; when executed from non-standard paths it loads the co-located malicious dui70.dll.
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\Run\LockScreenContentServer_MuODG5yBMRegistry Run key persistence entry that re-executes LockScreenContentServer.exe on logon, using a randomized service-like name to blend with legitimate Windows components.
- sha256026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872abMalicious dui70.dll variant.
- sha256032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22Malicious dui70.dll variant.
- sha25618c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278fSHA-256 hash of the initial ZIP archive (verify_pkg.zip) containing LockScreenContentServer.exe and malicious dui70.dll.
- sha256342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991eMalicious dui70.dll variant.
- sha2565d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8Malicious dui70.dll variant.
- sha2569a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24Malicious dui70.dll variant.
- sha256b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36aSHA-256 hash of the custom Python-based reverse tunnel implant (client.py).
- sha256ba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07SHA-256 hash of the malicious sideloaded DLL (dui70.dll) masquerading as the Windows DirectUI Engine.
- sha256df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabfMalicious dui70.dll variant.
- sha256eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0Malicious dui70.dll variant.
- sha256ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84dMalicious dui70.dll variant.
- urlhxxps://linked-log[.]comCompromised website used to display the fake Cloudflare Turnstile CAPTCHA overlay that initiates the TerminalFix social engineering attack.
Detection / Hunteropenrouter
What Happened
Attackers are compromising websites to show fake Cloudflare verification screens that trick people into copying and pasting a malicious command into their computer's terminal. Once run, the command downloads hidden malware that uses a legitimate Windows program as a disguise to avoid detection. The malware then downloads additional payloads hidden inside image files, sets up persistence to survive reboots, and maps out the organization's internal network. Finally, it installs a custom tunneling tool that gives the attacker a hidden pathway into the organization's internal systems through the compromised computer. Organizations should treat any affected computer as a potential gateway for attackers to reach other internal systems. Defenders should hunt for the specific indicators provided, rotate credentials accessible from affected machines, and educate users about fake CAPTCHA verification prompts.
Key Takeaways
- TerminalFix is a ClickFix variant that directs users to paste malicious PowerShell into Windows Terminal or PowerShell rather than the Run dialog, increasing the success rate of multi-line script execution.
- The campaign uses DLL sideloading via a legitimate signed binary (LockScreenContentServer.exe) loading a malicious dui70.dll, inheriting the trusted process reputation to evade defenses.
- Second-stage payloads are concealed inside PNG images using steganography, with a DLL split across two images and reassembled on disk after extraction from RGBA pixel data.
- A custom Python-based reverse tunnel implant (client.py) establishes a WebSocket tunnel over TLS to gitnow[.]dev:443, providing the attacker SOCKS5-style TCP proxy access into the victim's internal network.
- Extensive Active Directory reconnaissance includes domain trust enumeration, domain admin discovery, user description harvesting, and targeted server ping sweeps to identify high-value infrastructure.
Affected Systems
- Windows endpoints (domain-joined and non-domain-joined)
- Windows Terminal / PowerShell users
- Active Directory environments
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Compromised website displays fake Cloudflare Turnstile CAPTCHA overlay; user is instructed to paste a malicious PowerShell command into Windows Terminal.
- Execution: Pasted PowerShell downloads a ZIP archive to C:\ProgramData, extracts it, and launches 1.bat which executes LockScreenContentServer.exe silently.
- Defense Evasion: LockScreenContentServer.exe (signed legitimate binary) sideloads malicious dui70.dll from its working directory, inheriting the trusted process reputation.
- Payload Delivery: Sideloaded DLL executes PowerShell that downloads PNG images from attacker domains, extracts an executable and split DLL fragments from RGBA pixel data, and reassembles them on disk.
- Persistence: Malware establishes redundant persistence via HKCU Run key and a scheduled task running every 60 minutes; payload directory is hidden with attrib +h +s.
- Discovery: Extensive AD reconnaissance including domain trust enumeration, domain admin discovery, user description harvesting, and targeted server ping sweeps.
- Command and Control: A Python-based reverse tunnel implant (client.py) is downloaded and launched via pythonw.exe, establishing a WebSocket tunnel over TLS to gitnow[.]dev:443 providing SOCKS5-style TCP proxy access.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: Yes
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Microsoft Defender XDR Advanced Hunting (KQL)
Four KQL advanced hunting queries are provided in the article for Microsoft Defender XDR customers, covering ClickFix PowerShell execution, LockScreenContentServer.exe DLL sideloading from non-standard paths, custom reverse tunnel implant execution, and outbound connections to known C2 domains.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | The attack chain involves multiple process executions (PowerShell, cmd.exe, pythonw.exe), DLL loading events, registry modifications, scheduled task creation, and network connections that are well-covered by standard EDR telemetry. Process command lines, image load events, and registry writes provide strong visibility. |
| Network Visibility | Medium | Outbound TLS connections to gitnow.dev:443 and steganographic image downloads from attacker domains are visible at the network layer. However, the TLS encryption and use of legitimate-looking HTTPS traffic makes payload inspection difficult without SSL interception. |
| Detection Difficulty | Moderate | The use of a legitimate signed binary for DLL sideloading and steganographic payload delivery adds complexity. However, the specific behaviors — LockScreenContentServer.exe executing from non-standard paths, dui70.dll loading from ProgramData, pythonw.exe launching client.py, and outbound connections to known C2 domains — provide multiple detectable pivot points. |
Required Log Sources
- Process creation events (Event ID 4688 / Sysmon Event ID 1)
- Image load events (Sysmon Event ID 7)
- Registry modification events (Sysmon Event ID 12/13)
- Scheduled task creation events
- Network connection events (Sysmon Event ID 3)
- PowerShell script block logging (Event ID 4104)
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for LockScreenContentServer.exe executing from or loading DLLs from non-standard paths outside of C:\Windows\SystemApps, as this indicates DLL sideloading activity. | Process creation events and image load events (Sysmon Event ID 1 and 7, or EDR equivalent) | Defense Evasion / Execution | Low — LockScreenContentServer.exe is a specific binary that should only execute from its legitimate Windows system path. |
| Consider hunting for pythonw.exe processes launching scripts with command-line parameters referencing tunneling or C2 infrastructure, as this may indicate the reverse tunnel implant. | Process creation events with command-line logging (Event ID 4688 / Sysmon Event ID 1) | Command and Control | Medium — pythonw.exe is used legitimately by Python applications; filtering on specific command-line arguments like client.py, --server, --uuid, or gitnow.dev reduces false positives. |
| Consider hunting for PowerShell scripts using System.Drawing.Bitmap to read pixel values from PNG files, as this pattern is consistent with steganographic payload extraction. | PowerShell script block logging (Event ID 4104) and script content analysis | Defense Evasion / Payload Delivery | Medium — legitimate image processing scripts may use System.Drawing.Bitmap; correlation with network downloads of PNG files from non-standard domains improves accuracy. |
| Consider hunting for scheduled tasks created with 60-minute recurrence intervals that reference executables in C:\ProgramData, as this matches the persistence mechanism used by this campaign. | Scheduled task creation events and process creation events | Persistence | Low to Medium — 60-minute scheduled tasks executing from ProgramData are uncommon in typical enterprise environments. |
| Consider hunting for rapid sequences of Active Directory enumeration commands (nltest, net group, ADSI queries) originating from a single host within a short time window, as this indicates automated reconnaissance. | Process creation events, LDAP query logs, and Windows Security event logs | Discovery | Medium — administrative tools may perform similar enumeration; correlating with other campaign indicators reduces false positives. |
Control Gaps
- Network security controls without SSL interception cannot inspect the TLS-encrypted WebSocket tunnel to gitnow.dev:443.
- Application allowlisting that keys on process identity alone would not detect the attack, as LockScreenContentServer.exe is a legitimate signed binary.
- Traditional file-type inspection may not flag PNG images as malicious, as the steganographic payloads are embedded within valid image pixel data.
- Antivirus signature-based detection may miss the Python-based implant, as it uses an unmodified signed Python runtime from python.org with malicious logic isolated in client.py.
Key Behavioral Indicators
- LockScreenContentServer.exe executing from C:\ProgramData or other non-standard paths
- dui70.dll loading from a path co-located with LockScreenContentServer.exe outside System32
- pythonw.exe executing client.py with --server and --uuid arguments
- PowerShell downloading ZIP archives to C:\ProgramData with randomized subdirectory names
- Registry Run key entries with randomized service-like names under HKCU referencing executables in ProgramData
- Scheduled tasks with 60-minute recurrence executing from ProgramData paths
- attrib +h +s applied to directories under C:\ProgramData
- PowerShell scripts invoking System.Drawing.Bitmap to iterate pixel RGBA values
- Rapid sequence of nltest, net group, and ADSI enumeration commands from a single host
False Positive Assessment
Low — The specific combination of LockScreenContentServer.exe executing from non-standard paths, dui70.dll sideloading, pythonw.exe launching client.py, and outbound connections to the identified C2 domains provides high-fidelity detection opportunities with minimal overlap with legitimate activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider isolating any hosts showing indicators of this campaign, as the reverse tunnel provides attackers with network-level access through the compromised machine.
- Consider prioritizing credential rotation for any credentials accessible from affected machines, including domain admin accounts if the host was domain-joined.
- If your EDR supports host isolation, consider isolating affected endpoints to prevent the reverse tunnel from being used as a network pivot point.
- Consider blocking the known C2 domains (gitnow.dev, bestsocialmedianewspapper.com, offlineupdater.com) at your DNS resolver, firewall, or web proxy if not already blocked.
Infrastructure Hardening
- Consider restricting PowerShell execution for standard users using AppLocker, Application Control for Windows, or Group Policy.
- Evaluate whether PowerShell Constrained Language Mode can be enforced in your environment to reduce the risk of malicious script execution.
- Consider enabling PowerShell script block logging (Event ID 4104) to detect and analyze obfuscated or encoded commands.
- If supported by your tooling, consider deploying application control policies that prohibit native Windows binaries from executing from user-writable directories like C:\ProgramData.
- Evaluate whether SSL inspection can be deployed for outbound HTTPS traffic to improve detection of TLS-encrypted C2 channels.
User Protection
- Consider educating users about ClickFix and TerminalFix tactics, specifically fake CAPTCHA verification pages that instruct them to paste commands into Terminal, PowerShell, or the Run dialog.
- If applicable, consider deploying enterprise-managed browsers with security features such as SmartScreen or equivalent phishing protection.
- Consider enabling cloud-delivered protection in your endpoint protection platform to cover rapidly evolving attacker tools and techniques.
- Evaluate whether network protection and web protection features in your endpoint security product can be enabled to block malicious sites and internet-based threats.
Security Awareness
- Consider incorporating ClickFix/TerminalFix awareness into existing security awareness programs, emphasizing that legitimate websites never ask users to paste commands into terminals or Run dialogs.
- Consider training users to recognize fake Cloudflare Turnstile CAPTCHA overlays and report suspicious verification prompts.
- If your organization uses phishing simulation, consider including ClickFix-style fake CAPTCHA scenarios to measure user susceptibility.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping17 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Discovery
Tactic
Command and Control
Additional IOCs
- File Hashes:
026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab(SHA256) - Malicious dui70.dll variant.032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad22(SHA256) - Malicious dui70.dll variant.df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabf(SHA256) - Malicious dui70.dll variant.eb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0(SHA256) - Malicious dui70.dll variant.5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c8(SHA256) - Malicious dui70.dll variant.9a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24(SHA256) - Malicious dui70.dll variant.342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e(SHA256) - Malicious dui70.dll variant.ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d(SHA256) - Malicious dui70.dll variant.
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\LockScreenContentServer_MuODG5yBM- Registry Run key persistence entry that re-executes LockScreenContentServer.exe on logon, using a randomized service-like name to blend with legitimate Windows components.
- File Paths:
C:\ProgramData\f47f2a8c21c9df4e- Initial extraction directory for the downloaded ZIP archive containing the sideloading payload kit.C:\ProgramData\5da97240b3fd0f5b- Payload directory used for persistence; hidden with attrib +h +s to reduce forensic visibility.
- Command Lines:
- Purpose: Execute the sideloading batch file silently after ZIP extraction | Tools:
cmd.exe,1.bat,LockScreenContentServer.exe| Stage: Initial execution |cmd /c "<dest>\1.bat" "<dest>\LockScreenContentServer.exe" >nul 2>&1 & - Purpose: Establish registry Run key persistence for the sideloaded payload | Tools:
reg.exe| Stage: Persistence - Purpose: Create a scheduled task to re-execute the payload every 60 minutes | Tools:
schtasks.exe| Stage: Persistence |schtasks /create /tn <taskname> /tr <exepath> /sc minute /mo 60 /f - Purpose: Hide the payload directory using system and hidden file attributes | Tools:
attrib.exe| Stage: Defense evasion |attrib +h +s <directory> - Purpose: Launch the Python reverse tunnel implant with no visible console window | Tools:
pythonw.exe,client.py| Stage: Command and control |pythonw.exe client.py --server <c2> --uuid <id>
- Purpose: Execute the sideloading batch file silently after ZIP extraction | Tools:
- Other:
LockScreenContentServer_MuODG5yBM- Masquerading name used for both the registry Run key and scheduled task persistence entries, chosen to blend with the legitimate Windows Lock Screen component.
