Hackers Exploit ConnectWise ScreenConnect CVE-2024-46805 Critical Vulnerability

Key Takeaways

• Cybercriminals are employing “ClickFix” social engineering tactics to deploy sophisticated malware loaders and Python-based reverse tunnels on Windows systems.
• The attack chain leverages trusted Microsoft executables through DLL sideloading and uses encrypted communication channels to maintain persistent access.
• While a recent incident was contained before ransomware deployment, the observed tools and methods bear resemblance to the Vice Society cybercrime group, known for distributing Rhysida ransomware.
• Researchers have analyzed two distinct loader families, “Lorem Ipsum Loader” and “AxolotlLoader,” detailing their evasion techniques and shared infrastructure.
• Organizations are urged to implement robust user training, monitor for unusual process activity, and scrutinize network traffic for indicators of compromise.

Sophisticated ClickFix Attacks Deploy Malware and Python Tunnels on Windows

A new wave of cyberattacks is leveraging social engineering techniques, dubbed “ClickFix,” to infiltrate Windows environments with advanced malware loaders and establish persistent Python-based tunnels. These intrusions create critical access points that could facilitate devastating ransomware deployments.

A recent incident in late September demonstrated a complete infection chain initiated by a user executing a seemingly innocuous command. This action triggered a multi-stage attack that weaponized legitimate Microsoft programs, concealed malicious code, and utilized encrypted network communications to maintain stealth. Although the attack was successfully mitigated before any ransomware could encrypt systems, the tactics, techniques, and procedures (TTPs) observed align with those previously attributed to Vice Society, a prominent cybercrime syndicate linked to Rhysida ransomware. This connection strongly suggests a ransomware objective, even without direct evidence of encryption in this specific case.

Researchers from Forescout identified a new threat actor tool, “Lorem Ipsum Loader,” during their investigation. They conducted a comprehensive analysis of five Lorem Ipsum samples alongside 39 samples of “AxolotlLoader.” Their technical analysis of both loaders, published on October 14, revealed a novel installer-based delivery method, shared command-and-control (C2) traffic patterns, and notable differences between these two malware families.

Hackers Leverage ClickFix and Python Tunnels for Initial Access

The “ClickFix” methodology relies on tricking users into executing commands under the guise of system verification or problem-solving. A variant, “TerminalFix,” specifically directs victims to interact with Windows Terminal or PowerShell. Previous reports on fake Cloudflare CAPTCHA prompts have illustrated how this social engineering approach can establish a reverse tunnel into corporate networks without exploiting any inherent software vulnerabilities.

In the specific incident analyzed by Forescout, the initial infection began with ZIP archives. These archives contained a legitimate, signed Microsoft executable, a malicious Dynamic Link Library (DLL), and a batch script. When the trusted program was launched, it was manipulated to load the malicious DLL located in the same directory, a technique known as DLL sideloading. Concurrently, the batch script established persistence by creating a registry startup entry and a scheduled task configured to run hourly.

The malicious DLL itself contained an additional section housing encoded instructions. A sophisticated multi-layered decoding process was employed, beginning with a dictionary of 260 random five-letter words to decipher the initial hidden payload. A subsequent layer utilized XOR decoding, while an embedded JPEG file served as a decoy to further obscure the malicious components. These steps were designed to conceal the downloader before its code executed in memory. Following this, the loader restored specific parts of a Windows library from a clean disk copy, a tactic aimed at evading endpoint monitoring solutions. It then spawned a new instance of its host program, injected its code into this fresh process, and terminated the original process. A unique marker and mutex were used to prevent multiple instances of the malware from running simultaneously.

Python Tunnel Establishes Persistent Command and Control

For command and control, the Lorem Ipsum loader utilized a “dead-drop” resolver method. It retrieved encoded server information from profiles hosted on legitimate public forums, effectively separating the C2 server list from the malware’s core components. After initial registration, the loader polled for new tasks every five seconds, masquerading its network traffic as originating from Firefox. The final payload delivered was a Python tunnel client. This client established encrypted TLS connections on port 443, subsequently upgrading to WebSocket communication.

Similar ClickFix Python proxy attacks have been observed employing various tools to achieve the same objective: maintaining a persistent communication channel into a compromised environment after the initial breach.

Through this established tunnel, the remote server gained the ability to request TCP connections to specified destinations and relay data bidirectionally. Multiple connections could be sustained concurrently. Keepalive messages ensured continuous access, while a specific shutdown command allowed the threat actor to terminate the client. The use of browser-like headers further helped the connection evade detection by appearing less suspicious.

Forescout also uncovered a distinct delivery chain involving a modified Microsoft Teams MSI installer and two PowerShell stages. One PowerShell script was responsible for unpacking a GZIP-compressed payload, which then allocated memory and executed the embedded code. Prior reports on fake Microsoft Teams installers have documented other ransomware-linked campaigns abusing this same trusted software brand, though with different payloads.

A comparative analysis revealed three variants of AxolotlLoader distributed across various host programs. In contrast to Lorem Ipsum’s word-based encoding, Axolotl utilized embedded PNG data for shellcode decryption. Both malware families exhibited shared registration patterns and hosting links, yet their underlying codebases differed. Forescout posited a likely evolutionary relationship between the two but emphasized that definitive confirmation was not possible. This distinction is crucial, as the presence of a loader or tunnel does not inherently confirm the execution of ransomware. While other ClickFix-related ransomware campaigns have demonstrated lateral movement capabilities, each stage of an attack chain must be independently verified. In this particular incident, containment measures successfully interrupted the chain before the suspected final ransomware payload could be deployed.

Forescout strongly advises organizations to implement comprehensive user training programs. Furthermore, defenders should actively monitor for unusual PowerShell process chains, DLL loads originating from non-standard Windows directories, and correlating registry entries and scheduled tasks. It is also critical to review non-browser access to forum profiles and scrutinize suspicious registration traffic. While shared hosting addresses and reported TLS fingerprints can aid investigations, they should be treated as supporting detection signals rather than conclusive proof of compromise.

Indicators of Compromise (IoCs)

Confirmed Network Indicators

Source: Forescout’s confirmed network IoC table.

Additional Source-Reported Hunting Artifacts

Source: Forescout’s analysis and detection guidance.

Unconfirmed Pivot Indicators

These values were derived from infrastructure pivots and were not individually confirmed as malicious within the report. Duplicate domain entries have been removed.

Lorem Ipsum and Delivery-Chain SHA-256 Values

Hash strings below are transcribed exactly from the source. Some source-published strings appear shorter than the standard 64 hexadecimal characters; they have not been padded or silently corrected and should be verified before automated matching.

AxolotlLoader SHA-256 Values

The following table preserves all 39 sample strings and their variant groupings as published by Forescout, including any apparent source-length errors.

Variant / host	Source-published SHA-256
A1 / Task Explorer	0d1953c17fa0d705ea86d79b3df0ef8e0c5a49053acdce09fdbd07f74a23a7c6
A1 / Task Explorer	29491ba6d7d8ca6850c68a067f01cdb917904b7a61b4299255c90a6cd6b78b48
A1 / Task Explorer	3a7d7e18c2a4beef280c564a90516af931ecb9be0dbacbe905b5df2c2f73682c
A1 / Task Explorer	54e71dabe16426e3f96500236a5de4ea5ed8ba74af5eb2b5ccb4c885dad9d60c
A1 / Task Explorer	5ce2c6a2eb3ebd2f66d72cdbeec4c98ce507b0bc317c5beedd61053b4f871e75
A1 / Task Explorer	7d1fa95404b611ed1301e9a676f0fd6b90f24cd7c766b605bc9c0d08516b1f73
A1 / Task Explorer	8b6e79b74859b22dbe9ef9d9ae2c27236640f062560fb4a9d743245d2389091a
A1 / Task Explorer	a557a320aa0c8fed986cd969596481b23d2c77abf7469e67b70f1231f0103682
A1 / Task Explorer	cf184310de31b720d0294d673b308eb7b82fdab4d7999953cdf12acef9631c03
A1 / PE Detective	3d3d9d404a54a43f0d500546f54e64fb944705fff41f93d5e82ad7024eba8ba9
A1 / PE Detective	5d00d7882328e6d10c7e9dc4ab241ea507286efe4e3d87c2be8436d0af703581
A1 / PE Detective	68848814c4efb2269b898a53cf0ffa265cd7fb58ca4cc71c90206e5e4444d6c7
A1 / PE Detective	95fc2dd8decd8c37ac3e985b63a58fd477bc98888d0754e7f041f7f1f8d0f043
A1 / PE Detective	acfecbebe0e30deafec6ef578c4adea2ba7c2279d92df808018142819bd8808f
A1 / PE Detective	ee046a0baa3bbb928192e8fcf13533e806acba1fef6d93f4be24edb27e4bd811
A1 / PE Detective	f66c6ec3837107d3163fc260921d598375cc5a9beae06e961bf4b073fb2b7664
A1 / VS Web Protocol Handler	267d4018543138409387506aabafe2318980ae3cf5e06ebe2675bf36cb24116c
A1 / VS Web Protocol Handler	3c8d7b6c7a37fb489c3d62b4427c3c09b5b8f3797a02d0465d4828c9812a62eb
A1 / VS Web Protocol Handler	8f6e2d874ac99b12bd0451b554a522894923b6858ee9ca11fdf011aa1ca67f59
A2 / OLE/COM Object Viewer	186d4c16a3758b20967d712582fbe74e7dc0d566ff99753adcb11dc857006a96
A2 / OLE/COM Object Viewer	1cb54b0217afe3bb8d4b2577f5be4f16cbd00b3e2c79ec18ebb1d9daad0e3588
A2 / OLE/COM Object Viewer	24fc515ddfc5c60cfdc2f369831cf462ca7b14318a925aaee261272ff9a394d2
A2 / OLE/COM Object Viewer	2c439ef59a7ed4510ac93924f12e690b291b887624356aa8269ac5b3e307ef16
A2 / OLE/COM Object Viewer	4bcf66570431b60c9822d444071f909ab9c235c675ece1649e8c64dc061622cb
A2 / OLE/COM Object Viewer	786ebc7d74a5229495a44eaf6bd422a53cfaefdd555596d037eaffa76f434b69
A2 / OLE/COM Object Viewer	9bda1a463f363f67db1905824b28bf16f3e927752a15b7d5ac3d307125509718
A2 / OLE/COM Object Viewer	9c45329f4334ef71d927ec66ea277cc276087628054881303f78ef0b2cac93b8
A2 / OLE/COM Object Viewer	a9ac7de9161d9ca3a791179beee7a51c1b94d4c381e131308e6586b6009dd867
A2 / OLE/COM Object Viewer	b3c5b9b37bcc9093439e9846c9f175bad09121c9809fee2bd96835419eceec7e
B / IE Add-on Installer	004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26
B / IE Add-on Installer	0fb48494ed9b87a63f24a4b09923d2aeb0fa63585d85e823c1cbb5250cbd8a0f
B / IE Add-on Installer	12049c977e193972b665995720243571cf775f6f0428460192536d92c8528dbb
B / IE Add-on Installer	7dc54e91f58ec057f2596598b81ededf5c6c0976725bf2c1a2fc032f4d87f2f2
B / IE Add-on Installer	8643a4a4612b85f78cf246039bec6252caa56b4ed018978d9b42789e9058d1e6
B / IE Add-on Installer	a09eee349d00f3cdc17562eb2b2373efba1fa5c498da94ee38c102918cb095a7
B / IE Add-on Installer	abe4a4dbb2de862a3fba8b4efd58cacd020eac3a70bb6a8f92eec74c23dedc91
B / IE Add-on Installer	b43820a5dd317a18cc21d529e2dc242a705c45a204b1b01a7106d4407e5a7e24
B / IE Add-on Installer	d08e8ba4011438dacca0db41877febd6b6995936ddebe88d2cd124ec03182af6
B / IE Add-on Installer	f8a1c837254b8be9204f073f91af53946 Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources. Tags: AttackBreachCVEExploitHackerMalwareransomwareSecurityThreatVulnerability Share Article Link Copied! Emy Elsamnoudy Emy is a cybersecurity analyst and reporter specializing in threat hunting, defense strategies, and industry trends. With expertise in proactive security measures, Emily covers the tools and techniques organizations use to detect and prevent cyber attacks. She is a regular speaker at security conferences and has contributed to industry reports on threat intelligence and security operations. Emily's reporting focuses on helping organizations improve their security posture through practical, actionable insights. Previous Post AI Agents Expose API Keys and Cloud Secrets, Creating New Credential Surface Next Post Chinese Phishing Network Targets 75,000 Orgs With 1 Billion Messages No Comment! Be the first one. Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * Save my name, email, and website in this browser for the next time I comment. Related Posts By Jennifer sherman Threats GlassWorm Attacks macOS via Malicious VS Code… January 1, 2026 By Emy Elsamnoudy Attacks ClickFix Attack Hides Malicious Code via Stegan Security January 1, 2026 By Sarah simpson Vulnerabilities MongoBleed Detector Tool Released to Detect MongoDB Vulnerability(CVE-2025-14847) January 1, 2026 By Emy Elsamnoudy Breaches Conti Ransomware Gang Leaders & Infrastructure Exposed January 1, 2026