Threats Tagged 'supper'

Multiple ClickFix campaigns were identified employing three distinct delivery mechanisms while sharing common characteristics including DLL sideloading, consistent file-naming conventions, and command-and-control dead drops. The first campaign used remotely hosted MSI packages containing legitimate software to sideload malicious DLLs. The second leveraged NodeJS to execute JavaScript files, while the third utilized Python 3.5 to conceal and execute payloads. All campaigns originated from ClickFix lures and employed aggressive social engineering tactics, including direct phone contact directing victims to compromised WordPress sites. Post-compromise activity included extensive discovery commands and Active Directory enumeration. Infrastructure overlap and tactics indicate connections to the Lorem Ipsum malware family and Vanilla Tempest operations, with potential ransomware deployment as the final objective.