Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity.

The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious commands, often under the pretence of fixing a technical problem or completing a verification step.

The investigations reveal how attackers deliver different malware families, conceal malicious files and establish access that could support further compromise.

ROMULUS serves multiple malware loaders

During an incident investigation, Forescout researchers discovered a server hosting a panel called ROMULUS. Further analysis identified six IP addresses exposing the same authentication interface and revealed a platform capable of delivering multiple malware loaders.

One of those addresses had previously been identified by Huntress in a campaign that abused ChatGPT’s Custom GPTs to direct victims towards pages hosting ClickFix lures. Forescout independently observed the same malware package being delivered from another ROMULUS server.

Researchers analysed two delivery routes. One used a trojanised installer containing legitimate Stardock software to load malicious code. The other delivered LegionLoader, a malware loader active since 2019, through a series of encrypted archives.

In the LegionLoader route, an archive smaller than 1 MB expanded into an executable exceeding 880 MB. Most of the executable’s size came from artificial padding, which can push files beyond security scanners’ upload limits or sandbox analysis thresholds.

A ROMULUS statistics page also displayed installation and execution counts, a timeline and a breakdown by country, potentially allowing operators to monitor campaign performance.

Forescout said the platform’s operators remain unknown. Researchers could not determine whether ROMULUS is a private tool, a commercial criminal service, an affiliate framework or software shared between operators.

Loader investigation reveals possible connection

The second blog examines Lorem Ipsum and Axolotl, two malware loaders whose relationship had not previously been documented in public research.

The investigation followed a September incident in which attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained the incident before ransomware was deployed, although researchers believe ransomware delivery was the attackers’ intended goal.

The tradecraft has previously been attributed to Vice Society, a cybercriminal group associated with several ransomware families, including Rhysida.

Researchers analysed five Lorem Ipsum samples from the incident and 39 Axolotl samples. They identified an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, as well as three Axolotl variants using different host programs.

The analysis also found overlapping infrastructure and similarities in the loaders’ command-and-control communications. Although their code is distinct, Forescout said the findings suggest Lorem Ipsum may be a later iteration of Axolotl. Researchers could not establish that relationship conclusively.

Forescout recommends monitoring suspicious PowerShell activity, silent installer execution and unexpected DLL loading, alongside educating users about ClickFix and related lures that direct victims to Windows Terminal or PowerShell.

The post Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks appeared first on IT Security Guru.

Researchers at Huntress have detailed two ransomware incidents involving Settra, a relatively new strain first observed in June, and revealed a consistent set of post-compromise tactics defenders can use to spot the threat before encryption takes hold.

In a blog post published this week, Huntress researchers Harlan Carvey and Lindsey O’Donnell-Welch said the company had investigated two Settra attacks since July: one at a consumer services and retail organisation, and a second, in September, at a manufacturing firm. In the more recent case, the Huntress agent was only installed after the environment had already been compromised, meaning the attacker may still have been active on the network at the time.

Huntress said it was unable to confirm exactly how the attackers first gained access in either case. However, prior public reporting, including analysis published in July by incident response firm MoxFive, has linked Settra activity to compromised VPNs and stolen credentials as likely initial access routes.

A repeatable playbook

Despite occurring roughly two months apart and at unrelated organisations, the two intrusions followed a strikingly similar pattern. In both cases, the ransomware executable was named after the victim’s own domain, with “_win64.exe” appended, and both incidents saw the attackers deploy the legitimate MeshAgent remote monitoring and management (RMM) tool to maintain persistent access.

In the July incident, MeshAgent was renamed to mvtcs.exe and communicated with a command-and-control address at 45.13.122[.]7. The ransomware binary itself was launched a day later from the C:\Perflogs folder, encrypting files with a “.locked” extension and dropping a ransom note titled RESTORE_FILES.txt. The attackers went on to clear multiple Windows Event Logs, disable the Windows Recovery Environment using reagentc /disable, flush the DNS cache, and run diskpart to remove a recovery partition. They also used the native Windows cipher utility to overwrite free disk space, making file recovery significantly harder.

In the September incident, MeshAgent was left under its default name and pointed to a different C2 address, 193.5.65[.]114, an IP address also found in the tool’s certificate metadata and in active connections on the compromised endpoint at the time. Encrypted files carried a “.locked_wip” extension, and the ransomware was launched from the compromised user’s Documents folder rather than Perflogs. Unlike the July case, this intrusion showed evidence of Bring Your Own Vulnerable Driver (BYOVD) activity, via a driver named gdrv.sys, a technique typically used to disable or blind endpoint security tools.

A telling typo

One detail stood out to Huntress analysts: while the ransomware attempted to clear twelve separate Windows Event Logs during the September attack, one entry in the list was misspelled, referencing “Microsoft-Windows-Defender/Operational” instead of the correct “Microsoft-Windows-Windows-Defender/Operational”. As a result, that particular log survived the clean-up attempt, inadvertently leaving investigators an extra source of forensic evidence.

Huntress also linked the September attack to a workstation named WIN-LIVFRVQFMKO, which its analysts said they had observed in connection with unrelated incidents dating back to December 2024, and which had previously been tied to the same 193.5.65[.]114 IP address as far back as November 2025.

Part of a wider pattern

Huntress noted that Settra is the latest in a string of emerging ransomware variants its SOC has tracked this year, following strains such as Crux, KawaLocker and Cephalus. While the researchers said there is currently no public evidence that Settra operates on a ransomware-as-a-service (RaaS) basis, they stressed that the underlying techniques on display (RMM abuse, BYOVD, and attempts to erase Windows Event Logs) remain common across many ransomware operations, regardless of branding.

The researchers urged defenders to keep a close eye on unexpected RMM installations, monitor for attempts to disable Windows recovery options or clear event logs, and maintain strong detection coverage of post-compromise behaviour rather than relying solely on preventing initial access.

Huntress published indicators of compromise from both incidents, including the two MeshAgent C2 addresses, the malicious workstation name, the RESTORE_FILES.txt ransom note, the gdrv.sys driver, and the two file extensions used to mark encrypted files.

The post New Settra Ransomware Strain Deploys MeshAgent RMM for Persistence appeared first on IT Security Guru.

Huntress researchers have uncovered two phishing attacks that combined convincing fake browser windows with legitimate remote management software to establish persistent access to victims’ devices.

Both incidents, observed in August, began with phishing messages directing victims to attacker-controlled websites. The attackers then used a browser-in-the-browser (BiTB) technique to create what appeared to be a legitimate Adobe webpage, before convincing victims to download malicious software disguised as an Adobe Reader update.

Rather than deploying conventional malware, the attackers installed rogue instances of ScreenConnect, legitimate remote monitoring and management (RMM) software, giving them continued remote access to compromised endpoints.

Fake browser makes phishing harder to spot

BiTB attacks create a fake browser window inside a webpage using HTML, CSS and JavaScript. The window can replicate familiar features including an address bar, padlock and legitimate-looking URL, making traditional advice such as checking the web address less effective.

In the first attack, detected on 25 August, a victim clicked a link in a phishing email and was taken to a fake CAPTCHA page. They were subsequently presented with blurred documents and told they needed to download Adobe PDF Reader to view them.

The fake browser page appeared to show Adobe’s legitimate get.adobe.com address. However, the supposed Reader installer was actually ScreenConnect.

Once installed, the attackers deployed two rogue ScreenConnect clients, providing redundant routes for maintaining access. They then executed HideCursor.exe, a defence-evasion tool designed to conceal on-screen activity. Huntress intervened before the attack could progress further.

Second attack follows same playbook

Huntress identified another incident on 31 August involving the same Adobe Reader lure.

This time, the victim interacted with a malicious link delivered through AT&T Office@Hand, a legitimate communications service powered by RingCentral. The attackers again disguised ScreenConnect as an Adobe Reader update and installed two unauthorised instances.

The second ScreenConnect session was used to execute another defence-evasion binary, HideUL.exe. Microsoft Defender detected part of the activity, but the rogue ScreenConnect client still completed its installation before Huntress shut down the attack.

Legitimate tools remain attractive to attackers

The attacks demonstrate how threat actors can combine familiar phishing techniques with trusted software to make malicious activity harder to identify.

RMM abuse is a growing problem. Huntress’ 2026 Cyber Threat Report found RMM abuse increased 277% year on year and appeared in nearly a quarter of the incidents investigated by the company.

Huntress recommends organisations restrict who can install remote management tools, maintain an approved inventory of RMM software and monitor for new or unauthorised ScreenConnect clients. Employees should also be wary of unexpected software updates or file-viewing prompts, even when a webpage appears to display a legitimate address.

Read the full research here. 

The post Huntress Uncovers Phishing Attacks Using Fake Browser Pages and Rogue RMM Tools appeared first on IT Security Guru.