Originally reported by BleepingComputer
TL;DR
Security researchers have linked Termite ransomware deployments to Velvet Tempest threat actors using the ClickFix social engineering technique. The campaign leverages legitimate Windows utilities and deploys DonutLoader malware along with the CastleRAT backdoor to establish persistence before ransomware execution.
Active ransomware campaign using sophisticated social engineering techniques combined with legitimate Windows utilities for evasion. The threat actor has demonstrated capability to breach organizations and deploy ransomware payloads.
Security researchers at BleepingComputer have identified connections between recent Termite ransomware breaches and the threat actor group Velvet Tempest. The attackers are leveraging the ClickFix social engineering technique alongside legitimate Windows utilities to deploy a multi-stage infection chain.
The campaign follows a sophisticated multi-stage approach:
Velvet Tempest employs the ClickFix technique, a social engineering method that tricks users into executing malicious code by presenting fake error messages or system prompts that require user interaction to "fix" supposed issues.
Once initial access is achieved, the threat actors deploy:
The attackers extensively use legitimate Windows utilities to blend their activities with normal system operations, making detection significantly more challenging for security teams.
This campaign demonstrates several concerning trends in ransomware operations:
Security teams should focus on:
Originally reported by BleepingComputer