← Back to Feed
TerminalFix and Lorem Ipsum Loader enable covert tunneling
September 30, 2026 · Sophos Threat Research · Severity: MEDIUM
This Sophos threat research article reveals that TerminalFix and Lorem Ipsum Loader are being used for covert tunneling as part of an ongoing campaign. The tools enable stealthy communication and are linked to previous attacks that employed different delivery methods, indicating an evolving threat. 📌 **Analyst Note:** The use of covert tunneling tools like TerminalFix underscores the need for deep packet inspection and behavioral analysis to detect anomalous traffic patterns. Security teams should review network logs for signs of encrypted or unusual outbound connections that may indicate such tunneling activity.
Key Takeaways
- Sophos researchers identified TerminalFix and Lorem Ipsum Loader as tools enabling covert tunneling, linking them to a broader campaign that previously used different delivery mechanisms to compromise systems.
- These tools allow attackers to establish hidden communication channels, bypassing network security controls and exfiltrating data or receiving commands without detection by traditional monitoring solutions.
- The evolution of delivery methods in this campaign highlights the adaptability of threat actors, who continuously refine their techniques to evade defenses and maintain persistent access to targeted networks.