#dllsideloading

Read Time:3 Minute, 21 Second

A Windows intrusion investigated in late September used a ClickFix lure, memory-resident malware and Python-based tunnels to build the kind of foothold commonly used before a ransomware deployment. Defenders interrupted the incident before files were encrypted, but researchers say the tools and techniques resembled activity previously associated with Vice Society, a group linked to Rhysida ransomware.

The investigation by Forescout examined a loader called Lorem Ipsum Loader alongside 39 samples of the related AxolotlLoader family. The analysis found a new installer-style delivery chain, overlapping command infrastructure and a layered approach designed to hide activity inside trusted Windows processes.

ClickFix turns the victim into the entry pointClickFix attacks do not depend on exploiting a software vulnerability. They present fake verification steps, error messages or technical fixes that persuade a user to copy and run a command. A variation known as TerminalFix directs the victim toward Windows Terminal or PowerShell, effectively convincing the target to launch the attack.

In the observed chain, ZIP archives contained a legitimate signed Microsoft executable, a malicious dynamic-link library and a batch script. Running the trusted program caused it to load the nearby hostile library through DLL sideloading. Because the initial executable was validly signed, the sequence could appear less suspicious to users and some security controls.

The batch script established persistence through both a registry startup entry and a scheduled task that executed every hour. Multiple persistence paths increase the chance that the attack survives a reboot or the removal of a single component.

Layers of concealment protect the loaderThe malicious DLL stored encoded instructions in an added section. Researchers found a dictionary of 260 random five-letter words used to decode part of the payload, followed by another XOR-based decoding layer. An embedded JPEG served as a decoy while the downloader prepared its code in memory.

The loader also restored portions of a Windows library from a clean copy on disk, behavior intended to interfere with endpoint-monitoring hooks. It then started another instance of its host application, injected code into that process and terminated the original. A mutex and unique marker prevented multiple copies from running at once.

These steps matter because each stage reduces the amount of obviously malicious code written to disk. Trusted binaries, process injection and in-memory execution can complicate detection when defenders rely mainly on filenames or static signatures.

Python creates an encrypted route insideThe campaign’s next stage installed a Python environment and tunnel components that could give operators a route back into the compromised network. Encrypted tunneling can hide command traffic inside connections that resemble ordinary web activity and can provide access to internal services not normally exposed to the internet.

That remote access is valuable to ransomware operators. It gives them time to explore the network, obtain higher privileges, locate backups and identify high-value systems before launching encryption. In this case, the attack was stopped before that final stage, so attribution to Vice Society or Rhysida remains an assessment based on similarities rather than confirmed responsibility.

What defenders should watch forUsers launching copied PowerShell or terminal commands after web verification prompts.

Signed applications loading unexpected DLL files from archive or user-writable folders.

New hourly scheduled tasks and unusual registry startup entries.

Python installations or tunnel processes appearing on systems that do not require them.

Injected child processes and outbound encrypted connections to unfamiliar infrastructure.

Organizations can reduce the attack surface by training staff that CAPTCHA and support pages should never require pasted terminal commands. Application control can prevent unsigned libraries and scripts from running in temporary directories, while behavioral monitoring can connect the separate signs of sideloading, persistence and tunneling.

The incident demonstrates how ransomware preparation can look mundane in isolation. A copied command, a signed Microsoft binary and a Python process may each seem explainable. When they occur in sequence, they form a high-confidence warning that an intruder is building durable access and should be contained before the disruptive payload arrives.

Source: Cyber Security News.

Read Time:3 Minute, 35 Second

A malware campaign is using financial-document lures sent through WhatsApp to install a Windows remote access trojan with SYSTEM-level privileges. The infection begins when a recipient opens a ZIP archive and runs an executable presented as a statement or tax-related file. What follows is a layered chain designed to evade analysis, disable selected defenses and establish durable remote control.

Morphisec researchers identified the final payload as VulcanRAT207.A. Its operators can inventory a host, execute commands, manage files, capture screens, log keystrokes, manipulate accounts and deploy additional malware. For organizations that routinely exchange invoices or payment documents over messaging platforms, the campaign turns a familiar business workflow into a high-impact endpoint threat.

A staged loader tests the environmentThe initial Statement.exe file is packed with NRV2E compression, obscuring the underlying loader from straightforward static inspection. Once launched, it checks whether the computer resembles a genuine user workstation rather than a sandbox. The checks cover disk size, memory, processors, display properties, event logs, Registry data, virtual-machine artifacts and installed security products.

Timing tests provide another way to abandon execution inside slow emulation environments. Splitting the intrusion across unpacking, privilege escalation, injection, downloading, driver installation and persistence also means that no single component displays the entire malicious behavior.

Injection turns Task Scheduler into a SYSTEM hostIf the process lacks administrator rights, it attempts elevation through COM objects and can fall back to the Windows runas mechanism. It then enables SeDebugPrivilege and restores a clean copy of ntdll.dll, an effort intended to remove user-mode monitoring hooks installed by security software.

The loader injects downloader shellcode into the service process that hosts Windows Task Scheduler. Instead of the familiar CreateRemoteThread technique, it uses PoolParty Variant 7 and Windows I/O completion behavior. Because the target service runs as LocalSystem, the later stages inherit the operating system’s highest local privilege level.

The injected code contacts 61[.]18[.]208[.]27 on port 8888 to retrieve an in-memory deployment bundle. That package contains a legitimate Intel-signed VulkanInfo utility, a malicious vulkan-1.dll, an encoded RAT container named vulkan-1.bin and a deployment library.

Signed components help suppress defensesThe deployment stage attempts to install GoFly64.sys, a legitimately signed Chinese network-filter driver. By sending process identifiers to the driver through control code 0x12227A, the malware can terminate selected Baidu security processes at kernel level. Abuse of a valid signature does not make the activity benign; it instead lets the attacker bring a trusted component into a malicious chain.

The malware then writes its Vulkan-related files beneath C:\Program Files\Common Files. When the legitimate vulkaninfo-64.exe runs, Windows searches the local directory and loads the attacker’s adjacent vulkan-1.dll. This DLL sideloading technique gives malicious code the appearance and execution context of a signed application.

Persistence hides behind update-like namesA scheduled task named USOPrivate Kit or USOPrivate restarts the signed VulkanInfo host with SYSTEM permissions. The naming resembles Windows Update terminology, which may reduce suspicion during a cursory review. The sideloaded DLL reconstructs VulcanRAT from the nearby binary container and keeps the trusted process active.

VulcanRAT uses HTTP for initial retrieval and WebSocket version 13 for command-and-control traffic. Its command set covers processes, services, applications, event logs, files, user accounts and network connections. Operators can open a shell, control the keyboard and mouse, alter clipboard content, inject into other processes, create local administrators and add Windows Filtering Platform rules.

Detection and containment prioritiesBlock or quarantine executable files and password-protected archives received through WhatsApp and similar messaging services.

Hunt for the USOPrivate task and Vulkan-related files in the Common Files directory.

Alert on unexpected driver services or temporary files under the Windows drivers folder, especially activity involving a GoFly device.

Investigate Task Scheduler service processes showing unusual memory injection or outbound connections.

Block the reported command server at network controls and search historical telemetry for connections to port 8888.

Endpoints showing these indicators should be isolated before credentials are reset or evidence is collected. Because the RAT can log keystrokes and manipulate local accounts, responders should assume secrets used after infection may be exposed. Reimaging, credential rotation and a review of lateral movement are safer than simply deleting the visible files.