ReliaQuest documented a ClickFix intrusion chain that combined scheduled task persistence, a PowerShell-based C2 agent, and PySoxy to create redundant encrypted access paths on the compromised host. The attackers used domain reconnaissance and staged Python tooling to maintain access even after outbound connections were blocked, highlighting the need to treat these events as active compromises. #ClickFix #PySoxy #ReliaQuest #PowerShell
Keypoints
- ReliaQuest observed a new ClickFix campaign that used scheduled task persistence and PySoxy, a Python SOCKS5 proxy, to establish encrypted proxy access.
- The intrusion began with a user-executed PowerShell command from a compromised website and continued beyond initial execution into persistence and C2.
- A scheduled task repeatedly relaunched a staged PowerShell script from C:ProgramData, allowing the attacker to recover after blocked outbound connections.
- The recovered PowerShell script functioned as a lightweight RAT, polling attacker infrastructure every three seconds and returning command output.
- Before deploying PySoxy, the attackers performed domain reconnaissance, host discovery, and staging activity to confirm the environment and infrastructure path.
- PySoxy was executed from a non-standard Python bytecode file in C:ProgramData and used proxy-style arguments to reach attacker-controlled infrastructure over encrypted traffic.
- ReliaQuest emphasized that blocked C2 does not equal containment; defenders must remove persistence, staged scripts, Python artifacts, and proxy tooling.
MITRE Techniques
- [T1053.005] Scheduled Task/Job: Scheduled task persistence was used to relaunch the staged script every ~40 minutes, keeping access alive even after the callback was blocked (‘a scheduled task on the affected computer kept trying to restart the activity for hours’).
- [T1059.001] Command and Scripting Interpreter: PowerShell was the primary execution environment for the initial stager, the C2 logic, and follow-on commands (‘an obfuscated PowerShell command launched from explorer.exe’).
- [T1027] Obfuscated Files or Information: The initial PowerShell command was obfuscated to make detection harder (‘The command was built to make detection harder’).
- [T1106] Native API: The script executed payloads in memory and compiled commands dynamically without writing them to disk (‘executed it in memory without writing the payload to disk’).
- [T1059.003] Windows Command Shell: Built-in Windows command-line tools were used for discovery and environment mapping (‘whoami /groups’, ‘nltest.exe /dclist:’).
- [T1087.002] Domain Account: The attackers checked group memberships to identify the compromised account’s privileges (‘check group memberships’).
- [T1018] Remote System Discovery: The attackers enumerated domain controllers and discovered additional hosts (‘Domain controller enumeration via nltest.exe /dclist:’).
- [T1135] Network Share Discovery: SMB activity against discovered systems was used during environment mapping (‘SMB activity against discovered systems’).
- [T1090.001] Internal Proxy: PySoxy was used to route encrypted traffic through the compromised host as a proxy (‘route encrypted traffic through a compromised host’).
- [T1105] Ingress Tool Transfer: The attacker downloaded staged Python tooling and transferred local logs to attacker infrastructure (‘curl.exe … -o C:ProgramDatapythonb64.pyc’).
- [T1071.001] Web Protocols: The PowerShell C2 and PySoxy traffic used HTTP/S-style communication over web ports and endpoints (‘http://:443//tasks’, ‘remote_port 443’).
- [T1057] Process Discovery: The command logic used the current PID and host metadata for tracking sessions (‘X-PID’ = “$PID”).
Indicators of Compromise
- [IP addresses] attacker infrastructure and proxy destinations – 185.205.211[.]217, 206.206.103[.]120, and other 2 IPs
- [Domains] ClickFix staging and secondary C2 infrastructure – strapness[.]com, abledom[.]net, and overlateise[.]com
- [File names / paths] staged payloads and proxy bytecode – C:ProgramDatapythonb64.pyc, C:ProgramData.log
- [URLs / endpoints] C2 and staging endpoints used for tasking and file transfer – hxxp://206.206.103[.]106:5000/, http://:443//tasks
- [Process / command-line artifacts] suspicious execution patterns – powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden, python.exe b64.pyc -ssl -remote_port 443 -remote_ip 167.99.158[.]97
- [Script / tool names] observed tooling and staged components – b64.pyc, PySoxy, and the ClickFix stager script injected into the compromised site
Read more: https://reliaquest.com/blog/threat-spotlight-clickfix-evolves-with-pysoxy-proxying/