TerminalFix Attacks Deploy Lorem Ipsum Loader to Create Covert Tunnels Into Corporate Networks
Sophos tracks STAC4924 TerminalFix attacks deploying Lorem Ipsum Loader via Windows Terminal lures to build covert TLS tunnels into corporate networks.
Sophos reports newly tracked intrusion set STAC4924 uses TerminalFix social-engineering lures that prompt victims to paste PowerShell into Windows Terminal, downloading a ZIP that sideloads the malicious dui70.dll through the signed LockScreenContentServer.exe binary. The sideloaded Lorem Ipsum Loader, previously tied by BlueVoyant to trojanized Microsoft Teams installer campaigns, stores shellcode as ordinary English words decoded at runtime and uses Letsdiskuss profiles as dead-drop resolvers with JPEG-disguised C2 traffic. A final Python implant under Users\Public\indigo establishes an encrypted WebSocket tunnel over TLS 443 with per-victim UUIDs, converting hosts into covert proxies; Microsoft's related analysis observed Active Directory enumeration, domain-trust discovery, scheduled-task persistence, and SOCKS-style proxying. The campaign pivoted from signed trojanized Teams installers to TerminalFix lures after Microsoft disrupted the Fox Tempest code-signing service.