TerminalFix Unmasked: Fake CAPTCHAs Lead to Deep Network Infiltration via Windows Terminal

A new and highly sophisticated variant of the ClickFix malware, dubbed TerminalFix, has been uncovered by Microsoft, posing a significant threat to organizations across various sectors. Unlike its predecessors, TerminalFix employs a cunning strategy to trick users into executing malicious commands directly within Windows Terminal or PowerShell, drastically increasing the success rate of complex, multi-line scripts.

The Deceptive Lure: Fake Cloudflare CAPTCHAs

The TerminalFix campaign initiates its attack through compromised websites. Unsuspecting visitors are presented with convincing, yet entirely fake, Cloudflare CAPTCHA verification prompts. These deceptive prompts coerce users into copying and executing a malicious PowerShell command, setting the stage for a multi-stage intrusion.

Anatomy of a Sophisticated Attack Chain

Microsoft security researchers Sagar Patil, Suriyaraj Natarajan, and Parasharan Raghavan detailed the intricate attack chain, highlighting its advanced techniques:

1. Initial Execution and DLL Sideloading

• The malicious PowerShell command downloads a ZIP archive.
• This archive contains a legitimate executable, “LockScreenContentServer.exe,” bundled with a rogue DLL, “dui70.dll.”
• A DLL sideloading attack is then initiated, where the legitimate application inadvertently loads the malicious DLL.

2. Payload Extraction and Persistence

• The sideloaded DLL springs into action, retrieving subsequent payloads. These payloads are cleverly hidden within PNG images hosted on external domains like “bestsocialmedianewspapper[.]com” or “offlineupdater[.]com” – a technique known as steganography.
• To ensure long-term access, TerminalFix establishes persistence through both Registry Run keys and scheduled tasks.

3. Extensive Active Directory Reconnaissance

Before deploying its final payload, the malware conducts a thorough reconnaissance of the victim’s network. This phase involves:

• Collecting system metadata.
• Performing domain trust discovery and enumerating domain administrators.
• Searching for Active Directory users and computers.
• Pinging named servers to meticulously map the internal network topology.

4. The Reverse-Tunnel Backdoor: Deep Infiltration

The culmination of the attack chain is the deployment of a Python-based reverse-tunnel command-and-control (C2) implant, named “client.py.” This bespoke backdoor is exceptionally dangerous:

• It tunnels arbitrary TCP traffic back to attacker-controlled infrastructure (“gitnow[.]dev:443”) via an encrypted WebSocket channel.
• Crucially, it enables the C2 server to reach any host visible from the victim’s network, effectively turning the compromised machine into a persistent network-level proxy.

Adding another layer of stealth, the attack also establishes a persistent PowerShell file-watch loop. This loop continuously monitors a text file for new commands, executes them using Invoke-Expression, and writes the results to an output file, providing attackers with a covert communication channel.

The Grave Implications for Enterprises

Microsoft emphasizes the severe danger posed by TerminalFix. “This type of intrusion is particularly dangerous because it provides attackers with direct access to an organization’s internal network through the reverse tunnel,” stated the security researchers. This unparalleled access, combined with the extensive reconnaissance capabilities, allows attackers to identify and compromise additional systems from within the network.

Such deep infiltration can be leveraged for a multitude of malicious activities, including privilege escalation, disabling security controls, exfiltrating sensitive data, and deploying ransomware. TerminalFix, therefore, represents a critical threat to enterprise environments, demanding immediate attention and robust defensive measures.

Fortifying Defenses Against TerminalFix

To mitigate the risks associated with TerminalFix and similar threats, Microsoft advises several key strategies:

• Restrict Execution: Limit PowerShell and Run dialog execution for standard users through solutions like AppLocker, Application Control for Windows, or Group Policy.
• Audit Run Dialog: Consider blocking or auditing the Windows Run dialog (Win+R) if it’s not essential for operations.
• Monitor for DLL Sideloading: Implement monitoring for indicators of DLL sideloading attacks.
• Employee Training: Educate employees to recognize and report ClickFix-style social engineering attacks.
• Enhanced Logging: Enable PowerShell script block logging to detect and analyze obfuscated or encoded commands, providing crucial forensic data.

Staying vigilant and implementing these proactive measures are paramount in protecting organizational networks from sophisticated threats like TerminalFix.

For more details, visit our website.

Source: Link