Cyber threat actors known as Velvet Tempest have been observed deploying sophisticated attacks involving Termite ransomware, utilizing the ClickFix social engineering technique and the CastleRAT backdoor.These intrusions, tracked by MalBeacon researchers, unfolded over 12 days in a simulated U.S. non-profit environment with over 3,000 endpoints.Velvet Tempest, active for at least five years, has affiliations with major ransomware strains like Ryuk, REvil, Conti, BlackCat, LockBit, and RansomHub.
The attacks begin with malvertising campaigns directing victims to fake CAPTCHA pages that trick users into pasting obfuscated PowerShell commands into the Windows Run dialog This ClickFix method bypasses browser security features, chaining cmd.exe processes and using legitimate tools like finger.exe to fetch malware loaders, often disguised as PDF archives.Subsequent stages involve PowerShell downloads, .NET compilation via csc.exe, and Python-based persistence in ProgramData directories.
Once inside, attackers conduct Active Directory reconnaissance, host discovery, and credential harvesting from Chrome browsers using hosted PowerShell scripts linked to Termite staging servers. They deploy DonutLoader to retrieve CastleRAT, a remote access trojan that steals credentials, logs keystrokes, captures screens, and employs UAC bypass via trusted binaries like ComputerDefaults.exe. CastleRAT hides its command-and-control servers using Steam Community profiles as dead-drop resolvers, blending traffic with legitimate web activity.
Although ransomware deployment was not observed in this intrusion, Termite—a Babuk-based variant emerged in late 2024—employs double-extortion by exfiltrating data before encrypting files. It deletes shadow copies with vssadmin.exe, empties the Recycle Bin, and targets high-profile victims like SaaS provider Blue Yonder and Australian IVF firm Genea. The group exploits vulnerabilities, such as those in Cleo's file transfer software, for initial access via phishing or compromised sites.
Organizations should prioritize defenses against ClickFix by training users on suspicious prompts, monitoring PowerShell abuse, and blocking anomalous tool executions like finger.exe or csc.exe. Implementing deception environments, as used by MalBeacon, aids early detection of such hands-on-keyboard activities. With Velvet Tempest's history of devastating breaches, vigilance against evolving ransomware tactics remains critical in 2026.