Dynamic-link library

ClickFix attackers borrow Siemens signature.

Attackers are bundling a genuine signed Siemens software center program with malicious DLLs, then using fake verification prompts to trick people into running it.

A flaw lets the program load those attacker supplied files and execute their code.

Huntress researcher Jose Oregon reported the vulnerability.

Like usually a click fix is like more like a random lure or a random like malvertising kind of watering hole attack, not something that's used for operational technology.

Yeah, the one thing I would say about this that makes it very interesting for everyone is that the Siemens software is legit and signed.

It's the malicious DLLs that they're sideloading in that is tricky.

Now, remember, the threat actor has to get the DLLs onto the box where the application sits in order to... effectively overwrite those dlls and get them to sideload so the infection would already have to occur by the time that they're doing this um and i guess that's where the click flicks lures are happening so essentially someone drives by gets click fixed this the payload is not necessarily an info stealer it's malicious dlls that get overwritten little interesting little interesting because I'll just say this, like if you're, maybe there's more to this story than there needs to be, but listen, if you are on an application server and you're using a browser to browse around and do things, that's a bad move, dude.

The warning matters because it shows AI is now accelerating routine security failures into faster, broader intrusions, cutting the time from access to damage to hours rather than days.

And finally, for today, security researchers have uncovered a Malfex NPM supply chain campaign in which the malicious package IAMGDECODE hides a Windows DLL loader that downloads encrypted shellcode from GitHub and injects it into dullhost.exe.

The package, still available and downloaded nearly 1000 times, is part of a broader and evolving operation that has repeatedly replaced removed packages to keep targeting Windows systems.

The malware can steal credentials, browser and wallet data, and gaming app files, while also enabling remote command execution and persistence, making any infected developer workstation a serious enterprise risk.

One of the key things out of this article I thought that was worth talking about, Scott, was really the reverse SSH tunneling.

Um, so they, they recovered a Windows DL- DLL named wt sapi32.dl- .dll, that masquerades as a Windows Terminal Server, uh, SDK API, and forwards the DLL's legitimate exports.

So its purpose is to launch, um, Windows open SSH client and then establish that reverse tunnel, and we kind of see that in really the primary command that's, that's sort of talked about where you're using that call for SSH and you have, you know, a similar SSH command line call.

Um, you do see the dash R within this which, which indicates or sets up the, the remote or reverse port forwarding.

Uh, Group IB specifically, uh, connects that behavior to that earlier Google threat intelligence report that I had mentioned, um, where UNC 1549 really relied heavily on those SSH reverse tunnels to establish, um, or get, get them established on compromised systems to leverage that mechanism for that C2 traffic.

Um, the Two Stroke backdoor, I did mention that.

So they discovered, uh, another DLL, this time containing a C++ backdoor that really very closely resembles, uh, Two Stroke, which again, Google Threat Intelligence reported, uh, last year.

The malware will, um, masquerade as a legitimate Windows terminal server, uh, SDK and forward exports...

And we did a lot of work to it to kind of reduce the false positives.

And before we did some of that work, It would match on DLLs, right? The binary data in DLLs would match to credit card data, right? Like what are the chances you're going to find credit card data in Windows System 32 versus in a file called payments.xlsx, right? Yeah.

Like that context is obvious, of course, when a human sees it.

But if you just scan an entire file system with this, and we did find credit card data in weird places, right? Like there was a large merchant services organization connected to a bank here in the US.