Forescout exposes ROMULUS malware delivery panel behind ClickFix campaigns and links Lorem Ipsum and Axolotl loaders to Vice Society tradecraft
Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication interface. One of them had previously been reported by Huntress in a campaign that abused ChatGPT Custom GPTs to steer victims to ClickFix lure pages. In a separate September incident, attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained it before ransomware was deployed, though researchers believe ransomware was the intended outcome. The operators of ROMULUS remain unknown.
Technical Details
- ROMULUS can deliver multiple malware loaders. Its statistics page shows installation and execution counts, a timeline and a per-country breakdown, so operators can track campaign performance.
- Two delivery routes were analysed. One uses a trojanised installer containing legitimate Stardock software to load malicious code. The other delivers LegionLoader (active since 2019) through a series of encrypted archives.
- In the LegionLoader route, an archive under 1 MB expands into an executable of more than 880 MB. The size comes mostly from artificial padding, which can exceed scanner upload limits and sandbox analysis thresholds.
- Forescout analysed five Lorem Ipsum samples and 39 Axolotl samples. It found an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, plus three Axolotl variants using different host programs.
- Overlapping infrastructure and similar C2 communications suggest Lorem Ipsum may be a later iteration of Axolotl. The code is distinct and the link is not conclusively established.
- The tradecraft in the September incident was previously attributed to Vice Society, a group associated with several ransomware families including Rhysida.
Remediation
- Monitor for suspicious PowerShell activity, silent installer execution and unexpected DLL loading.
- Train users on ClickFix and related lures that direct victims to Windows Terminal or PowerShell.
Linha do tempo
-
Forescout exposes ROMULUS malware delivery panel behind ClickFix campaigns and links Lorem Ipsum and Axolotl loaders to Vice Society tradecraft
ler a análise desta fonte ocultar
Forescout's Vedere Labs has documented ROMULUS, a previously unknown malware delivery platform used in ClickFix campaigns, and new delivery techniques for loaders tied to Vice Society ransomware activity. The server hosting the ROMULUS panel was found during an incident investigation, and six IP addresses exposed the same authentication interface. One of them had previously been reported by Huntress in a campaign that abused ChatGPT Custom GPTs to steer victims to ClickFix lure pages. In a separate September incident, attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained it before ransomware was deployed, though researchers believe ransomware was the intended outcome. The operators of ROMULUS remain unknown.
Technical Details
- ROMULUS can deliver multiple malware loaders. Its statistics page shows installation and execution counts, a timeline and a per-country breakdown, so operators can track campaign performance.
- Two delivery routes were analysed. One uses a trojanised installer containing legitimate Stardock software to load malicious code. The other delivers LegionLoader (active since 2019) through a series of encrypted archives.
- In the LegionLoader route, an archive under 1 MB expands into an executable of more than 880 MB. The size comes mostly from artificial padding, which can exceed scanner upload limits and sandbox analysis thresholds.
- Forescout analysed five Lorem Ipsum samples and 39 Axolotl samples. It found an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, plus three Axolotl variants using different host programs.
- Overlapping infrastructure and similar C2 communications suggest Lorem Ipsum may be a later iteration of Axolotl. The code is distinct and the link is not conclusively established.
- The tradecraft in the September incident was previously attributed to Vice Society, a group associated with several ransomware families including Rhysida.
Remediation
- Monitor for suspicious PowerShell activity, silent installer execution and unexpected DLL loading.
- Train users on ClickFix and related lures that direct victims to Windows Terminal or PowerShell.