STAC4924 Uses TerminalFix Lures and Lorem Ipsum Loader to Deploy Covert Tunnels

Sophos investigated STAC4924, a campaign using ClickFix-style social engineering to persuade victims to execute commands in Windows Terminal, a technique dubbed TerminalFix. The intrusions deployed Lorem Ipsum Loader through DLL sideloading, used a dead-drop resolver on letsdiskuss[.]com to locate command-and-control infrastructure, and exchanged encoded data disguised as JPEG files. The malware installed a portable Python runtime and a custom implant, client.py, that established encrypted WebSocket connections and relayed traffic through compromised systems. An accompanying Gurucul report highlights August investigations and provides domain and URL indicators plus a detection query for recorded web activity.

The campaign was active since at least March 2026. Sophos identified an earlier March–April phase using SEO-poisoned sites and trojanized Microsoft Teams MSI installers, followed by TerminalFix lures from late May through September after a malware-signing service takedown; it linked the phases with moderate confidence. Sophos said its findings support BlueVoyant’s attribution of Lorem Ipsum Loader to Rapid Brigantine, also tracked as GOLD VICTOR, but observed no ransomware encryption in STAC4924. TerminalFix is used by multiple threat actors and is not an attribution marker on its own. Defenders should review the published indicators against web telemetry and investigate suspicious Windows Terminal execution, DLL sideloading, unexpected Python runtimes, and outbound WebSocket tunneling.