Ransomware risk actors tracked as Velvet Tempest are utilizing the ClickFix method and bonafide Home windows utilities to deploy the DonutLoader malware and the CastleRAT backdoor.
Researchers at cyber-deception risk intelligence agency MalBeacon noticed the hackers’ actions in an emulated group surroundings over a interval of 12 days.
Velvet Tempest, additionally tracked as DEV-0504, is a risk group that has been concerned in ransomware assaults as an affiliate for a minimum of 5 years.
The actor has been related to deploying a few of the most devastating ransomware strains: Ryuk (2018 – 2020), REvil (2019-2022), Conti (2019-2022), BlackMatter, BlackCat/ALPHV (2021-2024), LockBit, and RansomHub.
Supply: MalBeacon
The assault was noticed by MalBeacon between February 3 and 16 in a duplicate surroundings for a non-profit group within the U.S. with greater than 3,000 endpoints and over 2,500 customers.
After acquiring entry, Velvet Tempest operators carried out hands-on keyboard actions, together with Energetic Listing reconnaissance, host discovery, and surroundings profiling, in addition to utilizing a PowerShell script to reap credentials saved in Chrome.
The script was hosted on an IP tackle that researchers linked to software staging for Termite ransomware intrusions.
In keeping with the researchers, Velvet Tempest gained preliminary entry by way of a malvertising marketing campaign that led to a ClickFix and CAPTCHA combine that instructed victims to stick an obfuscated command into the Home windows Run dialog.
Supply: MalBeacon
The pasted command triggered nested cmd.exe chains and used finger.exe to fetch the primary malware loaders. One of many payloads was an archive file disguised as a PDF file.
In subsequent levels, Velvet Tempest used PowerShell to obtain and execute instructions that fetched extra payloads, compile .NET parts by way of csc.exe in short-term directories, and deploy Python-based parts for persistence in C:ProgramData.
The operation finally staged DonutLoader and retrieved CastleRAT backdoor, a distant entry trojan related to the CastleLoader malware loader recognized for distributing a number of households of RATs and knowledge stealers, like LummaStealer.
Termite ransomware has beforehand claimed high-profile victims comparable to SaaS supplier Blue Yonder and Australian IVF large Genea.
Whereas Velvet Tempest is usually related to double-extortion assaults, the place sufferer programs are encrypted after stealing firm information, MalBeacon’s report notes that the risk actor didn’t deploy the Termite ransomware within the noticed intrusion.
A number of ransomware actors have adopted the CkickFix method in assaults. Sekoia reported in April 2025 that the Interlock ransomware gang used the social engineering technique to breach company networks.
Malware is getting smarter. The Crimson Report 2026 reveals how new threats use math to detect sandboxes and conceal in plain sight.
Obtain our evaluation of 1.1 million malicious samples to uncover the highest 10 strategies and see in case your safety stack is blinded.
