TerminalFix campaign hides payload in PNG pixels

Analysis of Microsoft's TerminalFix intrusion reporting shows attackers encoding a full PE loader and malicious DLL directly into PNG pixel data via steganography.

This SANS ISC diary is a technical deep-dive by Didier Stevens into steganography used in the TerminalFix campaign, originally reported by Microsoft Security Research as a multistage intrusion that deploys a reverse tunnel. Stevens obtained IOC PNG files from the Microsoft researchers and used pngdump.py to show that the images are structurally valid PNGs (proper IHDR/IDAT/IEND chunks, valid ZLIB-compressed and filtered scanline data) with no appended or metadata-based payload — instead, the entire pixel data itself encodes a hidden binary. Unlike typical LSB steganography that preserves the visual appearance of the carrier image, this campaign overwrites all bits of the RGBA pixel data, destroying the original image but maximizing payload capacity.

One PNG (SHA256 f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe) was shown to contain an embedded, legitimate signed Microsoft executable, LockScreenContentServer.exe, which is abused for DLL sideloading. Two additional PNG files, analyzed similarly, each contain one half of a malicious DLL; concatenating the two halves reconstructs the full malicious payload that LockScreenContentServer.exe is used to sideload. The technique allows attackers to smuggle executables and libraries through channels or scanners that may only inspect PNGs superficially (e.g., via magic bytes or basic image validation) rather than fully parsing and reconstructing pixel data.

For defenders, the key detail is the extraction method: legitimate PE content (MZ header, DOS stub, section names like .text/.data) can be recovered from the raw, filter-reversed scanline data, with an 8-byte little-endian length prefix indicating the embedded payload size. Detection should focus on the delivery chain (reverse tunnel infrastructure and sideloading of LockScreenContentServer.exe) reported by Microsoft, and on anomalous PNG files that decode successfully but render as corrupted or unrecognizable images — a strong indicator that all bit-planes were overwritten rather than a subset used for covert LSB stego.

title: DLL Side-Loading via LockScreenContentServer.exe
description: Detects LockScreenContentServer.exe execution in contexts where a malicious
  DLL could be loaded from the same or nearby directory. The process is a legitimate
  Microsoft binary commonly abused for sideloading.
tags:
- attack.persistence
- attack.defense-evasion
- attack.t1574.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \LockScreenContentServer.exe
  filter_system_path:
    Image|startswith:
    - C:\\Windows\\
    - C:\\Program Files\\
    - C:\\Program Files (x86)\\
  condition: selection and not filter_system_path
falsepositives:
- Legitimate Windows OS updates or repairs launching LockScreenContentServer.exe from
  standard system paths
level: high
id: 77cbdaf2-56e7-5b39-a657-9dae7257e698
status: experimental
author: Vorant

title: PNG File Decoding with Suspicious Binary Extraction
description: Detects suspicious patterns where PNG files are accessed or decoded by
  tools that parse image data (e.g., custom decoders, Python imaging libraries, or
  hex editors), potentially extracting embedded steganographic payloads. Focuses on
  the combination of PNG file handling and decoding activity rather than the PNG file
  itself.
tags:
- attack.defense-evasion
- attack.t1027.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_decoder:
    Image|endswith:
    - \python.exe
    - \python3.exe
    - \powershell.exe
    CommandLine|contains:
    - .png
    - PIL
    - Image.open
    - zlib
  filter_legitimate:
    CommandLine|contains:
    - windows\\system32
    - pip install
  condition: selection_decoder and not filter_legitimate
falsepositives:
- Legitimate image processing scripts or tools analyzing PNG files for quality or
  compression
- Python image libraries being used for standard image manipulation tasks
level: medium
id: ccf58923-5af6-5657-8a04-85a9479cb50a
status: experimental
author: Vorant

title: Reverse Tunnel or Proxy Tool Execution Following Payload Delivery
description: Detects execution of common reverse tunnel, proxy, or pivoting tools
  (e.g., ngrok, chisel, plink, socat, ssh.exe with tunnel flags) that are often deployed
  post-exploitation to establish C2 communication channels.
tags:
- attack.command-and-control
- attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_tunnel:
    Image|endswith:
    - \ngrok.exe
    - \chisel.exe
    - \plink.exe
    - \socat.exe
    - \ssh.exe
    CommandLine|contains:
    - ' -R '
    - ' -L '
    - reverse
    - tunnel
    - '-D '
  filter_admin:
    User|contains: SYSTEM
  condition: selection_tunnel and not filter_admin
falsepositives:
- IT administrators using SSH tunneling or plink for legitimate remote access or maintenance
- Development teams using ngrok or chisel for local testing
level: medium
id: 1b9b9f73-444d-5bcd-a1c8-6023a3597abf
status: experimental
author: Vorant

Source reporting: https://isc.sans.edu/diary/rss/33318