ClickFix Campaign Uses ActiveX to Deliver Epsilon Red Ransomware
Summary
CloudSEK found a ClickFix campaign using fake verification pages and ActiveX to silently download and run Epsilon Red. Related lures impersonate Discord, streaming services, and dating sites.
Key points
- Victims are directed from a fake verification page to a secondary page where ActiveX WScript.Shell runs commands through cmd.exe.
- The commands silently download and execute Epsilon Red from 155.94.155[.]227:2269; the report also identifies a Quasar RAT sample.
- The campaign impersonates Discord’s captcha.bot, streaming services including Kick and Twitch, and romance or dating sites.
- CloudSEK describes this as a variant of ClickFix that sends victims to another page rather than copying commands to the clipboard.
- The report maps the activity to MITRE techniques including T1189, T1059.003, T1059.005, and T1204.001.
- Recommended defenses include restricting ActiveX and Windows Script Host, blocking identified infrastructure, and detecting hidden command execution and browser-launched child processes.
Article Details
- Attack Vectors
- ClickFix-themed pages direct victims to a secondary page where ActiveX-based script runs shell commands to download and execute a payload.
- Fake verification codes and impersonation of services, streaming platforms, and romance or dating themes are used to increase the likelihood that victims follow staged instructions.
- The reported commands silently download a Windows executable using curl and run it without displaying a window.
- Defensive Notes
- Disable ActiveX and Windows Script Host through Group Policy to block legacy script execution vectors such as WScript.Shell.
- Ingest threat intelligence and block the reported attacker IPs and domains.
- Use endpoint behavior analytics to detect hidden shell execution, cmd /c, silent curl downloads, and suspicious browser child processes.
- Use security awareness training to prepare users for fake verification pages impersonating familiar services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | capchabot[.]cc | ClickFix delivery domain listed as an indicator. |
| DOMAIN | twtich[.]cc | ClickFix HTA delivery domain listed as an indicator. |
| IPV4 | 155[.]94[.]155[.]227 | Command-and-control infrastructure listed in the article; also hosts the reported payload URL. |
| IPV4 | 213[.]209[.]150[.]188 | Command-and-control infrastructure listed in the article. |
| MD5 | 2db32339fa151276d5a40781bc8d5eaa | Hash identified in the article as Quasar RAT malware. |
| MD5 | 98107c01ecd8b7802582d404e007e493 | Hash identified in the article as the Epsilon Red ransomware payload. |
| URL | hxxp[:]//155[.]94[.]155[.]227:2269/dw/vir[.]exe | Attacker-controlled URL used to download the Epsilon Red payload. |
MITRE ATT&CK
T1059.003 · Windows Command ShellThe downloaded command uses cmd.exe to run the payload and display a social-engineering message.T1059.005 · Visual BasicA webpage uses ActiveXObject("WScript.Shell") to run commands on the host.T1189 · Drive-by CompromiseVictims are lured to themed verification websites where malicious scripts execute.T1204.001 · Malicious LinkVictims are prompted to click a link and follow staged instructions on the themed pages.T1486 · Data Encrypted for ImpactThe article identifies Epsilon Red as ransomware and describes the infection leading to ransomware encryption.
Malware
Epsilon RedTRIAD uncovered a Clickfix-themed malware delivery site in active development, associated with the Epsilon Red ransomware. Unlike previous campaigns that copy commands to clipboards, this variant urges victims toQuasar RATQuasar RAT MalwareREvilas well as romance-themed lures. Epsilon Red was first observed in 2021 and is loosely inspired by REvil ransomware in ransom note styling, but otherwise appears distinct in its tactics and infrastructure.