Lorem Ipsum Loader (Malware): news timeline & CVEs

Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks

Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.

Forescout analyzed a late-September Windows intrusion that used ClickFix to deliver Lorem Ipsum Loader and a Python tunnel before containment stopped any ransomware. ZIP archives paired a signed Microsoft executable with a malicious DLL for sideloading, plus a startup registry entry and an hourly scheduled task. The loader decoded its payload, injected into a new host process, and retrieved command-server locations from public forum profiles. A separate chain abused a modified Teams MSI. Forescout compared 5 Lorem Ipsum samples with 39 AxolotlLoader samples and said methods resembled Vice Society and Rhysida activity, without confirming that group or encryption.

Cyber Security Newsupdated Oct 16, 14:42 UTC · 11h agofirst Oct 15, 14:30 UTC · 1d agoMalware in the wild 4 sources2· 1 read

New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access

A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.

A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunneling implant that can relay arbitrary TCP traffic and serve as a network pivot. In a late-September incident, a ZIP combined a legitimate executable, a malicious DLL, and a batch file; the DLL was sideloaded, persisted via a user Run key and scheduled task, reconstructed shellcode from a word dictionary, unhooked ntdll, and used process injection. Another path used a trojanized Microsoft Teams MSI and staged PowerShell. The loader contacts a dead-drop resolver, then runs client.py over a TLS WebSocket. Investigators assessed ransomware as a likely objective, but encryption was not observed; the family resembles but is not confirmed to be a later Axolotl Loader.

GBHackersupdated Oct 16, 14:42 UTC · 11h agofirst Oct 15, 12:53 UTC · 1d agoMalware in the wild 4 sources1

TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks

Sophos tracks STAC4924 TerminalFix attacks deploying Lorem Ipsum Loader via Windows Terminal lures to build covert TLS tunnels into corporate networks.

Sophos reports newly tracked intrusion set STAC4924 uses TerminalFix social-engineering lures that prompt victims to paste PowerShell into Windows Terminal, downloading a ZIP that sideloads the malicious dui70.dll through the signed LockScreenContentServer.exe binary. The sideloaded Lorem Ipsum Loader, previously tied by BlueVoyant to trojanized Microsoft Teams installer campaigns, stores shellcode as ordinary English words decoded at runtime and uses Letsdiskuss profiles as dead-drop resolvers with JPEG-disguised C2 traffic. A final Python implant under Users\Public\indigo establishes an encrypted WebSocket tunnel over TLS 443 with per-victim UUIDs, converting hosts into covert proxies; Microsoft's related analysis observed Active Directory enumeration, domain-trust discovery, scheduled-task persistence, and SOCKS-style proxying. The campaign pivoted from signed trojanized Teams installers to TerminalFix lures after Microsoft disrupted the Fox Tempest code-signing service.

GBHackersOct 1, 13:09 UTC · 15d agoMalware in the wild2· 1 read

Lorem Ipsum Loader

Timeline3 articles

Appears with

Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks

New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access

TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks