Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks | #ransomware | #cybercrime

Hackers-Use-ClickFix-and-Python-Tunnels-to-Prepare-Systems-for-Ransomware-Attacks.webp

Hackers are using ClickFix tricks to install malware loaders and Python tunnels on Windows systems, creating access that could support ransomware attacks.

A late September incident shows how a user running a command can start an infection chain built around trusted Microsoft programs, hidden code, and encrypted network traffic.

The attack was stopped before ransomware reached the affected systems. However, the tools and methods matched activity previously linked to Vice Society, a cybercrime group associated with Rhysida ransomware.

That connection points to a likely ransomware goal, not proof that encryption occurred or that the group carried out this incident.

Researchers from Forescout identified Lorem Ipsum Loader during the investigation and examined five samples alongside 39 AxolotlLoader samples.

Their technical analysis of both loaders, published October 14, describes a new installer-based delivery method, shared command traffic, and important differences between the malware families.

Hackers Use ClickFix and Python Tunnels

ClickFix persuades people to run commands presented as verification steps or fixes. Its TerminalFix variant directs users toward Windows Terminal or PowerShell.

Earlier reporting on fake Cloudflare CAPTCHA prompts showed how this approach can lead to a reverse tunnel into corporate networks without exploiting a software flaw.

Traditional delivery mechanism (Source – Forescout)

In the incident Forescout examined, ZIP archives contained a signed Microsoft executable, a malicious DLL, and a batch script.

Starting the trusted program caused it to load the nearby malicious library, a method called DLL sideloading. The script also created a registry startup entry and a scheduled task that ran hourly.

The malicious DLL carried an added section containing encoded instructions. A dictionary of 260 random five-letter words helped decode the hidden payload.

Another layer used XOR decoding, while an embedded JPEG acted as a decoy. These steps concealed the downloader before its code ran in memory. The loader then restored parts of a Windows library from a clean disk copy, a step intended to interfere with endpoint monitoring.

It launched another copy of its host program, injected code into that process, and ended the original process. A unique marker and mutex helped prevent duplicate instances.

Python Tunnel Gives Attackers a Route Back

To locate its command servers, Lorem Ipsum read encoded information from profiles on a legitimate public forum. This “dead-drop” method separated the server list from the malware itself.

After registration, the loader checked for tasks every five seconds, using traffic that claimed to come from Firefox. The final downloaded tool was a Python tunnel client. It connected over encrypted TLS traffic on port 443 and switched to WebSocket communication.

Related ClickFix Python proxy attacks have used different tools for a similar purpose: keeping a route into a compromised environment after the first infection.

Execution flow (Source – Forescout)

Through the tunnel, the remote server could request TCP connections to specified destinations and relay data in both directions. Several connections could remain active at once.

Keepalive messages maintained access, while a shutdown command let the operator stop the client. Browser-like headers helped the connection appear less suspicious.

Forescout also found a separate delivery chain using a modified Teams MSI installer and two PowerShell stages. One script unpacked a GZIP-compressed payload, which then allocated memory and executed code.

Earlier coverage of fake Microsoft Teams installers documents another ransomware-linked campaign abusing the same trusted software brand, although its payloads differed.

The comparison found three AxolotlLoader variants spread across different host programs. Unlike Lorem Ipsum’s word-based encoding, Axolotl used embedded PNG data to decode shellcode.

Both families shared registration patterns and hosting links, but their code differed. Forescout considered an evolutionary relationship likely, while stressing that it could not confirm one. That distinction matters because a loader or tunnel does not prove ransomware execution.

Coverage of ClickFix ransomware lateral movement shows how other malware chains can support later activity, but investigators must establish each stage separately. Here, containment interrupted the chain before the suspected final payload arrived.

Forescout recommends user training alongside checks for unusual PowerShell process chains, DLL loads outside normal Windows folders, and matching registry entries and scheduled tasks.

Defenders should also review non-browser access to forum profiles and suspicious registration traffic. Shared hosting addresses and the reported TLS fingerprint should support investigation rather than serve as standalone proof of compromise.

Indicators of compromise (IoCs):-

Confirmed Network Indicators