Ransomware menace actors tracked as Velvet Tempest are utilizing the ClickFix method and bonafide Home windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor.
Researchers at cyber-deception menace intelligence agency MalBeacon noticed the hackers’ actions in an emulated group atmosphere over a interval of 12 days.
Velvet Tempest, additionally tracked as DEV-0504, is a menace group that has been concerned in ransomware assaults as an affiliate for at the least 5 years.
The actor has been related to deploying a number of the most devastating ransomware strains: Ryuk (2018 – 2020), REvil (2019-2022), Conti (2019-2022), BlackMatter, BlackCat/ALPHV (2021-2024), LockBit, and RansomHub.
Supply: MalBeacon
The assault was noticed by MalBeacon between February 3 and 16 in a duplicate atmosphere for a non-profit group within the U.S. with greater than 3,000 endpoints and over 2,500 customers.
After acquiring entry, Velvet Tempest operators carried out hands-on keyboard actions, together with Lively Listing reconnaissance, host discovery, and atmosphere profiling, in addition to utilizing a PowerShell script to reap credentials saved in Chrome.
The script was hosted on an IP tackle that researchers linked to software staging for Termite ransomware intrusions.
Based on the researchers, Velvet Tempest gained preliminary entry by way of a malvertising marketing campaign that led to a ClickFix and CAPTCHA combine that instructed victims to stick an obfuscated command into the Home windows Run dialog.
Supply: MalBeacon
The pasted command triggered nested cmd.exe chains and used finger.exe to fetch the primary malware loaders. One of many payloads was an archive file disguised as a PDF file.
In subsequent phases, Velvet Tempest used PowerShell to obtain and execute instructions that fetched further payloads, compile .NET parts by way of csc.exe in non permanent directories, and deploy Python-based parts for persistence in C:ProgramData.
The operation in the end staged DonutLoader and retrieved CastleRAT backdoor, a distant entry trojan related to the CastleLoader malware loader identified for distributing a number of households of RATs and knowledge stealers, like LummaStealer.
Termite ransomware has beforehand claimed high-profile victims akin to SaaS supplier Blue Yonder and Australian IVF big Genea.
Whereas Velvet Tempest is usually related to double-extortion assaults, the place sufferer methods are encrypted after stealing firm knowledge, MalBeacon’s report notes that the menace actor didn’t deploy the Termite ransomware within the noticed intrusion.
A number of ransomware actors have adopted the CkickFix method in assaults. Sekoia reported in April 2025 that the Interlock ransomware gang used the social engineering technique to breach company networks.
Malware is getting smarter. The Pink Report 2026 reveals how new threats use math to detect sandboxes and conceal in plain sight.
Obtain our evaluation of 1.1 million malicious samples to uncover the highest 10 methods and see in case your safety stack is blinded.
