Top Highlights
- The TerminalFix campaign uses compromised websites to trigger malicious PowerShell commands via fake CAPTCHA verifications, enabling complex multi-stage malware deployment.
- Attackers leverage DLL sideloading, steganographic payloads, and custom reverse-tunnel implants for persistent, covert network access and internal reconnaissance.
- The backdoor facilitates remote control over infected networks, risking privilege escalation, data exfiltration, and deployment of ransomware within targeted organizations.
Threat, Attack Techniques, and Targets
Microsoft has identified a new campaign involving a threat called TerminalFix. This threat uses fake Cloudflare CAPTCHAs to trick users into running malicious commands. When victims visit compromised websites, they are prompted to copy and run a PowerShell command. This command downloads a ZIP file that contains both legitimate and malicious files.
The malicious files include a DLL used for a DLL sideloading attack. The DLL fetches additional payloads from external websites disguised as images. These payloads help the attacker gather information about the network, such as domain details and system data. The attack also deploys a reverse-tunnel backdoor. This backdoor allows hackers to maintain persistent access to the infected system and communicate with it securely over encrypted channels.
The attack targets organizations across multiple sectors. The techniques involve manipulating Windows Terminal or PowerShell to execute complex scripts. The attack chain uses ways like DLL sideloading, steganography, and reconnaissance to compromise systems and expand access within networks.
Impact, Security Implications, and Remediation Guidance
This threat poses serious risks to affected organizations. The reverse tunnel gives attackers direct access to internal networks. This access can help them escalate privileges or bypass security controls. Attackers can also steal sensitive data or deploy ransomware. Because of the attack’s complexity, it is difficult to detect in early stages.
The security implications are significant. Organizations should watch for signs of DLL sideloading and unusual PowerShell activity. Monitoring network traffic for suspicious outbound connections is also important.
For mitigation, it is recommended to restrict PowerShell and Run dialog use for regular users. Security tools like AppLocker or Group Policy can help with this. Blocking or auditing the Run dialog can prevent accidental execution. Teams should also monitor for DLL sideloading activities and enable PowerShell script block logging. This helps identify obfuscated or encoded malicious commands.
If you need specific remediation steps, it is advised to consult with the relevant security vendors or authorities.
Discover More Technology Insights
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
