Termite ransomware breaches linked to ClickFix CastleRAT attacks

Researchers at MalBeacon observed Velvet Tempest (DEV-0504) conduct a 12-day intrusion in an emulated nonprofit environment using a malvertising-driven ClickFix lure that convinced victims to paste obfuscated commands into the Windows Run dialog; operators executed nested cmd chains and legitimate Windows utilities (finger.exe, csc.exe, PowerShell) to stage DonutLoader and retrieve the CastleRAT backdoor, harvested Chrome credentials, and performed AD reconnaissance and host discovery — the group is a longstanding ransomware affiliate associated with multiple major ransomware families, though Termite ransomware was not deployed in this observed engagement.