Security researchers have uncovered a sophisticated attack strategy that combines a social engineering vector known as “ClickFix” with Python-based tunnels. The goal: prepare victim systems for ransomware deployment by establishing stealthy, persistent footholds long before any encryption takes place.
What new malware does and how it works
Detected by Forescout, the incident in late September involved Windows machines being compromised through a command the user believed to be a routine verification or fix step. Once executed, it triggered an infection chain using trusted Microsoft software, hidden DLLs, and encrypted communication channels. Although the attack was halted before ransomware emerged, the techniques closely resemble operations linked to the Vice Society group, known for Rhysida ransomware activity.
The attackers distributed ZIP archives containing a signed Microsoft executable, a malicious DLL, and a batch script. The legitimate program, when run, loads the malicious library (DLL sideloading). A registry entry and a scheduled task are also installed to ensure persistence, running every hour. The DLL houses encoded payloads decoded using a dictionary of 260 random five-letter words, with an embedded JPEG used to conceal further payload data. XOR decoding and clean system libraries are used to sidestep detection tools.
Python tunnels & remote control
The loader captures command server addresses by reading encoded information from user profiles on legitimate forums—these “dead-drop” profiles help to hide server lists from the malware itself. After initial registration, the loader checks for new tasks every five seconds, using traffic that mimics Firefox. The final payload delivered is a Python tunnel client, which uses TLS over port 443 and eventually upgrades to WebSocket communication. This channel allows the attacker’s remote server to relay TCP connections, maintain multiple simultaneous connections, and blend in using browser-like headers. A shutdown command allows operators to terminate the connection.
Forescout also observed an alternate delivery variant using a modified Microsoft Teams MSI installer and staged PowerShell scripts. That chain unpacks a GZIP-compressed payload into memory before executing it—another tactic to stay hidden early in a ransomware workflow.
Comparisons, detection, and response steps
Two malware families were analyzed: the newly observed “Lorem Ipsum” loader and the established AxolotlLoader strains. While Lorem Ipsum uses a wordlist-based encoding and hides server IPs via forum profiles, AxolotlLoader employs embedded PNG data to decode shellcode. Despite sharing infrastructure footprints and registration patterns, their codebases remain separate. Though no final encryption or ransomware payload was confirmed, the attack demonstrates all preceding infrastructure is now in place.
Detection can rely on unusual signs—PowerShell processes used in odd chains, DLLs loading from outside typical Windows directories, registry entries or scheduled tasks using random or obfuscated naming, and network traffic displaying TLS fingerprints or accessing forum profiles. Forescout advises combining user training with vigilant system and network monitoring to catch these early stages. Specific indicators of compromise, including domains, IP addresses, SHA-256 hashes, and file names, have been published to aid defenders in spotting these threats.
This attack follows a larger trend of threat actors using trusted software installers (like MSI packages) and DLL sideloading to bypass defenses, and leveraging Python tunnels for persistent access. Attack chains increasingly rely on layering obfuscation, decoy files, and embedding server and control data in innocuous places.
Analytical view: This new campaign exemplifies how ransomware groups are investing heavily in the pre-encryption phase—building stealth, persistence, and control. Defenders must shift some focus from “encryption prevention” to disrupting the earlier infection and connection phases. What organizations see as minor policy breaches—running a PowerShell script, installing MSI packages—can now be critical vectors. Watching for those risks, equipping staff to spot social engineering like ClickFix prompts, and tracking unusual network profiles or TLS signatures may be the difference between a contained incident and a full-blown breach.
