TerminalFix and Lorem Ipsum Loader enable covert tunneling
Summary
Sophos has identified a new campaign utilizing the TerminalFix and Lorem Ipsum Loader tools to establish covert tunnels. This activity is part of a larger, ongoing operation that previously employed different delivery methods.
IFF Assessment
FOE
The discovery of new tools and techniques enabling covert tunneling signifies an advancement in threat actor capabilities, posing a greater challenge for defenders.
Defender Context
Defenders should be aware of TerminalFix and Lorem Ipsum Loader as potential indicators of compromise, especially in campaigns employing covert tunneling. Monitoring network traffic for unusual connections and persistence mechanisms will be crucial for detection and response.