CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Velvet Tempest leverages ClickFix and CastleRAT in ransomware operations

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The threat group Velvet Tempest, also tracked as DEV-0504, has been observed using the ClickFix technique and legitimate Windows utilities to deploy DonutLoader malware and CastleRAT backdoor in a simulated environment. The group, known for deploying multiple ransomware strains, conducted Active Directory reconnaissance, credential harvesting, and environment profiling over a 12-day period. Initial access was gained through a malvertising campaign leading to a ClickFix and CAPTCHA mix. Despite their history with ransomware, Termite ransomware was not deployed in this observed intrusion.

Timeline

  1. 07.03.2026 18:14 1 articles · 3h ago

    Velvet Tempest observed using ClickFix and CastleRAT in simulated environment

    Between February 3 and 16, Velvet Tempest conducted Active Directory reconnaissance, credential harvesting, and environment profiling in a replica environment for a U.S. non-profit organization. The group used PowerShell to harvest credentials and deployed DonutLoader and CastleRAT backdoor. Initial access was gained through a malvertising campaign leading to a ClickFix and CAPTCHA mix. Termite ransomware was not deployed in this observed intrusion.

    Show sources
    Open in new tab

Information Snippets