Cybersecurity experts at Sophos X-Ops have uncovered a new social engineering campaign that relies on a tactic dubbed ‘TerminalFix’ to compromise enterprise networks. After Microsoft successfully disrupted fraudulent certificate-signing services earlier this year, threat actors quickly pivoted to alternative methods to infiltrate corporate environments. The latest research details how attackers now deceive users into manually pasting malicious commands into Windows Terminal, triggering a complex infection chain that establishes persistent remote access.[1]
Historically, this group of cybercriminals relied heavily on SEO-poisoned installers for legitimate applications, such as Microsoft Teams, to trick users into downloading malware. However, the changing security landscape has forced a notable shift in their operational strategy. The new TerminalFix tactic bypasses traditional email or attachment-based lures by targeting the human element through direct interaction. When a user is manipulated into pasting the provided command into the terminal interface, they unwittingly trigger an infection process that leverages multiple layers of sophisticated obfuscation, including DLL sideloading and steganography, to hide its tracks.
A critical component of this campaign is a new shellcode loader that Sophos has identified as the 'Lorem Ipsum Loader'. This tool is engineered to bypass standard entropy-based malware scanners. It achieves this evasion by using an English word-mapping technique that lets the malicious code mimic the structural characteristics of standard text files and evade automated security filters.
The attackers rely on dead-drop resolvers hosted on legitimate, trusted platforms, such as Letsdiskuss.com, to establish their initial communications without raising alarms. To further obscure their activities, attackers carefully encode command-and-control traffic inside standard JPEG images. This steganographic technique lets malicious instructions blend perfectly with normal web traffic, making it incredibly difficult for standard network defense tools to spot the anomaly.
Once the initial breach is successful and the host environment is prepared, the malware deploys a fully portable Python runtime. The malware then weaponizes this runtime to establish encrypted WebSocket tunnels back to the attackers' remote infrastructure. These covert tunnels are highly resilient and grant the threat actors persistent, hidden access to internal network resources. This foothold lets them move laterally across the network, exfiltrate sensitive data, or deploy additional destructive payloads at their discretion.
Sophos X-Ops confidently attributes the campaign's underlying tooling and infrastructure to the notorious threat group known as GOLD VICTOR. The global cybersecurity community also recognizes this prominent collective under several other aliases, including Vice Society, Rhysida, and Vanilla Tempest. The group is notorious for its aggressive intrusion tactics and significant financial impact on victim organizations, making this new TerminalFix infection method a critical concern for network administrators worldwide.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://www.cybersecurityintelligence.com/blog/attackers-deploy-covert-python-tunnels-for-network-access-9789.html
Comments