TerminalFix Campaign Builds Reverse Tunnels for Persistent Access

Summary

The TerminalFix campaign is a ClickFix variant that uses fake Cloudflare CAPTCHA overlays to socially engineer users into executing malicious PowerShell commands. The attack chain combines DLL sideloading, steganographic payload extraction from PNG images, and extensive Active Directory reconnaissance. The campaign ultimately deploys a custom Python-based reverse-tunnel implant that gives attackers persistent network-level proxy access.

Investigation

Microsoft Threat Intelligence analyzed the multi-stage attack chain, which abuses the legitimate signed LockScreenContentServer.exe binary for DLL sideloading. The investigation showed how malicious payloads are concealed within PNG pixels and how a Python runtime establishes a WebSocket-based reverse tunnel. Researchers also identified the command-and-control infrastructure and reconnaissance techniques used to map internal networks.

Mitigation

Organizations should restrict PowerShell execution through AppLocker or Group Policy and monitor for LockScreenContentServer.exe running from unusual or non-standard locations. Attack Surface Reduction (ASR) rules can help block obfuscated scripts and unauthorized executable launches. User awareness training focused on recognizing fake CAPTCHA prompts is also an important preventive measure.

Response

If TerminalFix activity is detected, affected devices should be treated as potential network pivot points and investigated for lateral movement. Credential rotation should be prioritized, particularly for domain administrator accounts accessible from the compromised system. Security teams should also perform forensic analysis for unauthorized Python runtimes and suspicious outbound WebSocket connections.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary intends to establish a persistent reverse tunnel. To blend in with system processes, they first drop a legitimate-looking binary, LockScreenContentServer.exe, into a directory. They then utilize DLL side-loading to execute malicious code. Following this, they initiate a Python-based tunnel using pythonw.exe (to avoid a visible console window) and execute a script named client.py. This sequence is designed to create a network-level backdoor that bypasses standard firewall restrictions via WebSocket tunneling.

• Regression Test Script:

  # Simulation Script: TerminalFix Reverse Tunnel Emulation
  # 1. Setup Environment
  $targetDir = "C:UsersPublicDownloadsSystemFiles"
  New-Item -Path $targetDir -ItemType Directory -Force
  
  # 2. Create dummy 'LockScreenContentServer.exe' (Simulating the sideloaded binary)
  # In a real attack, this would be a real PE file.
  $dummyExe = Join-Path $targetDir "LockScreenContentServer.exe"
  New-Item -Path $dummyExe -ItemType File -Force
  
  # 3. Create dummy Python script 'client.py'
  $pythonScript = Join-Path $targetDir "client.py"
  "print('Establishing tunnel...')" | Out-File -FilePath $pythonScript -Encoding ascii
  
  # 4. Execute the 'malicious' processes to trigger the detection logic
  # Trigger Part A: LockScreenContentServer.exe
  Start-Process -FilePath $dummyExe -WindowStyle Hidden
  
  # Trigger Part B: pythonw.exe with client.py in command line
  # Note: We use the full path to pythonw.exe as expected by the rule
  $pythonwPath = "C:WindowsSystem32pythonw.exe" 
  # If pythonw is not in System32, we locate it
  if (-not (Test-Path $pythonwPath)) {
      $pythonwPath = (Get-Command pythonw.exe).Source
  }
  
  Start-Process -FilePath $pythonwPath -ArgumentList $pythonScript -WindowStyle Hidden

• Cleanup Commands:

  # Cleanup Script
  $targetDir = "C:UsersPublicDownloadsSystemFiles"
  if (Test-Path $targetDir) {
      Remove-Item -Path $targetDir -Recurse -Force
  }