TerminalFix campaign deploys a reverse tunnel through multistage intrusion

Strategic summary

The TerminalFix campaign, a ClickFix variant, uses compromised websites with fake Cloudflare CAPTCHA overlays to trick users into executing a malicious PowerShell command. The attack employs multi-stage techniques such as DLL sideloading, steganographic extraction of payloads from PNG images, Active Directory reconnaissance, and a Python-based reverse-tunnel implant. This gives attackers persistent network access and allows them to use the compromised host as a pivot point for lateral movement. For Joel Traber AG, a manufacturing company in the DACH region, this campaign poses a serious risk, especially due to potential follow-on ransomware activity.

Key findings

• TerminalFix uses fake Cloudflare CAPTCHA overlays on compromised websites to lure users into copying and executing a PowerShell command.
• The PowerShell payload downloads a ZIP archive containing a legitimate binary (LockScreenContentServer.exe) and a malicious DLL (dui70.dll) for DLL sideloading.
• The campaign establishes dual persistence via Registry Run keys and scheduled tasks, and performs extensive Active Directory reconnaissance, including domain trust enumeration and admin discovery.
• A Python-based reverse-tunnel C2 implant tunnels arbitrary TCP traffic over an encrypted WebSocket channel to attacker infrastructure, enabling network pivoting.
• Affected devices should be treated as potential network pivot points; Microsoft recommends investigating for lateral movement and credential exposure.