TerminalFix Malware Campaign: PNG Steganography in Action

The TerminalFix malware campaign represents a sophisticated threat operation that leverages PNG steganography to conceal payloads and facilitate reverse tunneling. This campaign surfaced in early 2023, targeting industries with high-value data, including financial services and health sectors. Threat actors effectively employed this technique to bypass traditional detection mechanisms, showcasing an advanced understanding of both steganography and network intrusion tactics.

This breakthrough campaign, attributed to an advanced persistent threat group known within industry circles as APT-EXIF, has drawn attention due to its creative exploitation of innocuous image files to distribute malicious payloads and data exfiltration commands under the radar. Notably, the campaign’s activities were meticulously documented, revealing a pattern of attacks that took place over several months, demonstrating a calculated and deliberate approach to infiltration.

PNG steganography allows attackers to hide data within image files in a way that is challenging for conventional security measures to detect.

How It Was Built

The TerminalFix campaign was constructed using a blend of socially engineered emails and crafted image files containing embedded malicious scripts. The infrastructure set up by the threat actors involved C2 servers hosted in diverse geographic locations to impede easy tracking and takedown actions. These servers managed the distribution and command execution phases of the attack.

Emails appeared as legitimate business communications. For instance, subjects like “Quarterly Performance Review” or “Updated Contract Terms” were used to lure recipients. These emails were often sent from spoofed domains resembling trusted business partners.


From: updates@trustedpartner.com

To: recipient@targetcompany.com

Subject: URGENT: Action Required - Updated Contract Terms

Body: Please review the attached document for the latest contract updates.

The malicious PNG files attached carried embedded scripts concealed using steganographic techniques. When opened, these scripts initiated a connection to the C2 servers, establishing a reverse SSH tunnel. This method effectively masked the attack initiation, making it appear as routine outbound traffic.

Why It Worked

Several factors contributed to the success of this operation:

Legitimate Appearance: The use of authentic-looking email subjects and sender names effectively lowered the suspicion levels of targeted recipients. The emails seemed to come from actual business contacts, which is a vital social engineering facet.
Steganographic Techniques: By embedding payloads within graphics, the campaign bypassed conventional malware detection systems that rely on file signature recognition. This approach ensured that the initial payload delivery remained undetected until execution.
Network Concealment: Employing reverse tunneling methods disguised the exfiltration of data as regular network traffic, which can blend into the typical noise of daily business operations.

Operator Takeaways

For red team operators looking to replicate or learn from this campaign, the following elements are noteworthy:

Use of Steganography: Consider the potential of non-traditional payload delivery mechanisms such as steganography not just for covert communication but also for payload encapsulation.
Strategic C2 Infrastructure: Deploying C2 servers in a distributed manner can increase the resilience of an operation and complicate defensive counteractions.
Realistic Social Engineering: Tailoring phishing lures that closely mimic legitimate communications improves engagement rates significantly.

Do’s and Don’ts

Do’s

Innovate Payload Delivery: Use novel methods like steganography to subvert traditional detection systems.
Finesse Social Engineering: Craft messages and lures that are highly contextual to the target environment.
Diversify C2 Channels: Implement multiple C2 pathways to secure uninterrupted operation post-compromise.

Don’ts

Neglect Infrastructure Security: Always maintain operational security on C2 infrastructure to prevent interception.
Use Obvious Lures: Avoid generic subject lines that could easily arouse suspicion and scrutiny.