{"id":7037,"date":"2026-09-04T08:28:25","date_gmt":"2026-09-04T06:28:25","guid":{"rendered":"https:\/\/www.interlink.ro\/blog\/?p=7037"},"modified":"2026-09-04T08:28:27","modified_gmt":"2026-09-04T06:28:27","slug":"terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape","status":"publish","type":"post","link":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape","title":{"rendered":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\"><p class=\"ez-toc-title\" style=\"cursor:inherit\">Cuprins:<\/p>\n<\/div><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Pericolul_real_nu_se_limiteaza_insa_la_infectarea_calculatorului\" >Pericolul real nu se limiteaz\u0103 \u00eens\u0103 la infectarea calculatorului<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Cum_incepe_atacul_TerminalFix\" >Cum \u00eencepe atacul TerminalFix?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#PowerShell_descarca_prima_componenta_malitioasa_a_TerminalFix\" >PowerShell descarc\u0103 prima component\u0103 mali\u021bioas\u0103 a TerminalFix<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Ce_este_deturnarea_DLL-urilor\" >Ce este deturnarea DLL-urilor?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Steganografia_ascunde_componentele_malitioase_in_imagini\" >Steganografia ascunde componentele mali\u021bioase \u00een imagini<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#TerminalFix_isi_asigura_persistenta_pe_sistem\" >TerminalFix \u00ee\u0219i asigur\u0103 persisten\u021ba pe sistem<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Atacatorii_executa_o_recunoastere_a_retelei_si_a_domeniului\" >Atacatorii execut\u0103 o recunoa\u0219tere a re\u021belei \u0219i a domeniului<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Tunelul_invers_poate_transforma_calculatorul_compromis_intr-o_poarta_catre_retea\" >Tunelul invers poate transforma calculatorul compromis \u00eentr-o poart\u0103 c\u0103tre re\u021bea<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Ce_este_un_tunel_invers\" >Ce este un tunel invers?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#De_ce_este_periculos_accesul_prin_tunel\" >De ce este periculos accesul prin tunel?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#TerminalFix_comparat_cu_atacurile_ClickFix_obisnuite\" >TerminalFix comparat cu atacurile ClickFix obi\u0219nuite<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Cum_se_pot_proteja_organizatiile_impotriva_atacurilor_TerminalFix\" >Cum se pot proteja organiza\u021biile \u00eempotriva atacurilor TerminalFix?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#1_Nu_permiteti_utilizatorilor_sa_execute_comenzi_primite_de_pe_pagini_web\" >1. Nu permite\u021bi utilizatorilor s\u0103 execute comenzi primite de pe pagini web<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#2_Limitati_utilizarea_PowerShell_acolo_unde_este_posibil\" >2. Limita\u021bi utilizarea PowerShell acolo unde este posibil<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#3_Monitorizati_deturnarea_DLL-urilor_DLL_Sideloading\" >3. Monitoriza\u021bi deturnarea DLL-urilor (DLL Sideloading)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#4_Monitorizati_modificarile_de_persistenta\" >4. Monitoriza\u021bi modific\u0103rile de persisten\u021b\u0103<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#5_Monitorizati_recunoasterea_Active_Directory\" >5. Monitoriza\u021bi recunoa\u0219terea Active Directory<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#6_Instruiti_angajatii\" >6. Instrui\u021bi angaja\u021bii<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Ce_inseamna_TerminalFix_pentru_securitatea_companiilor\" >Ce \u00eenseamn\u0103 TerminalFix pentru securitatea companiilor?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\/#Ce_trebuie_retinut_despre_TerminalFix\" >Ce trebuie re\u021binut despre TerminalFix<\/a><\/li><\/ul><\/nav><\/div>\n<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Timp de citit: <\/span> <span class=\"rt-time\"> 6<\/span> <span class=\"rt-label rt-postfix\">minutes<\/span><\/span>\n<p>Cercet\u0103torii Microsoft au identificat o nou\u0103 campanie de atacuri cibernetice denumit\u0103&nbsp;<strong>TerminalFix<\/strong>, o variant\u0103 a ClickFix care vizeaz\u0103 organiza\u021bii din mai multe domenii. Atacul folose\u0219te site-uri compromise pentru a afi\u0219a utilizatorilor un CAPTCHA fals, asem\u0103n\u0103tor mecanismului Cloudflare Turnstile, \u0219i \u00eei convinge s\u0103 copieze \u0219i s\u0103 execute o comand\u0103 PowerShell.<\/p>\n\n\n\n<p>La prima vedere, utilizatorul pare s\u0103 efectueze o verificare obi\u0219nuit\u0103 pentru a demonstra c\u0103 este o persoan\u0103 \u0219i nu un program automat. \u00cen realitate, comanda copiat\u0103 de pe pagina web descarc\u0103 \u0219i execut\u0103 componente mali\u021bioase pe dispozitivul utilizatorului.<\/p>\n\n\n\n<p>Potrivit analizei publicate de Microsoft la 28 august 2026, TerminalFix reprezint\u0103 o evolu\u021bie a atacurilor de tip&nbsp;<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/08\/21\/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique\/\" target=\"_blank\" rel=\"noreferrer noopener\">ClickFix<\/a>. Spre deosebire de variantele anterioare, care \u00eei determinau frecvent pe utilizatori s\u0103 execute comenzi prin fereastra Windows Run, TerminalFix folose\u0219te&nbsp;<strong>Windows Terminal sau PowerShell<\/strong>. Acest lucru le permite atacatorilor s\u0103 execute scripturi mai complexe, inclusiv comenzi formate din mai multe linii.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"Pericolul_real_nu_se_limiteaza_insa_la_infectarea_calculatorului\"><\/span>Pericolul real nu se limiteaz\u0103 \u00eens\u0103 la infectarea calculatorului<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Lan\u021bul de atac poate continua cu&nbsp;<strong>deturnarea DLL-urilor, steganografie, mecanisme de persisten\u021b\u0103, recunoa\u0219terea infrastructurii Active Directory \u0219i instalarea unui tunel invers<\/strong>. Prin intermediul acestui tunel, calculatorul compromis poate deveni un punct de acces c\u0103tre alte sisteme din re\u021beaua organiza\u021biei.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Cum_incepe_atacul_TerminalFix\"><\/span>Cum \u00eencepe atacul TerminalFix?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Atacul \u00eencepe atunci c\u00e2nd utilizatorul acceseaz\u0103 un site compromis. Pagina legitim\u0103 este \u00eenlocuit\u0103 sau acoperit\u0103 cu o fereastr\u0103 care imit\u0103 verificarea Cloudflare Turnstile. Utilizatorului i se afi\u0219eaz\u0103 elemente familiare, precum sigla Cloudflare, mesajul \u201eVerify you are human\u201d, o caset\u0103 de verificare \u0219i o anima\u021bie care sugereaz\u0103 c\u0103 verificarea este \u00een desf\u0103\u0219urare.<\/p>\n\n\n\n<p>Scopul este de a crea suficient\u0103 \u00eencredere pentru ca victima s\u0103 urmeze instruc\u021biunile afi\u0219ate pe ecran.<\/p>\n\n\n\n<p>\u00cen loc s\u0103 \u00eei cear\u0103 doar s\u0103 bifeze o caset\u0103, pagina \u00eel determin\u0103 s\u0103 copieze \u0219i s\u0103 lipeasc\u0103 o comand\u0103 \u00een Windows Terminal sau PowerShell. Aceasta este componenta de inginerie social\u0103 a atacului.<\/p>\n\n\n\n<p>Utilizatorul nu este neap\u0103rat convins s\u0103 descarce un fi\u0219ier necunoscut. Este determinat s\u0103&nbsp;<strong>execute el \u00eensu\u0219i comanda<\/strong>, consider\u00e2nd c\u0103 aceasta face parte din procesul de verificare.<\/p>\n\n\n\n<p>Astfel ac\u021biunea mali\u021bioas\u0103 este prezentat\u0103 drept o opera\u021biune legitim\u0103 \u0219i necesar\u0103. Este una dintre caracteristicile care fac atacurile ClickFix at\u00e2t de eficiente.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"PowerShell_descarca_prima_componenta_malitioasa_a_TerminalFix\"><\/span>PowerShell descarc\u0103 prima component\u0103 mali\u021bioas\u0103 a TerminalFix<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Dup\u0103 ce utilizatorul execut\u0103 comanda, PowerShell descarc\u0103 o arhiv\u0103 ZIP de pe infrastructura controlat\u0103 de atacatori.<\/p>\n\n\n\n<p>Arhiva este extras\u0103 \u00een&nbsp;<p class=\"command\"><code>C:\\ProgramData<\/code><\/p>&nbsp;\u0219i con\u021bine mai multe componente. Printre acestea se afl\u0103 un executabil legitim,&nbsp;<strong>LockScreenContentServer.exe<\/strong>, \u0219i o bibliotec\u0103 DLL mali\u021bioas\u0103 denumit\u0103&nbsp;<strong>dui70.dll<\/strong>.<\/p>\n\n\n\n<p>\u00cen acest punct \u00eencepe o nou\u0103 etap\u0103 a atacului:&nbsp;<strong>deturnarea DLL-urilor<\/strong>.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Ce_este_deturnarea_DLL-urilor\"><\/span>Ce este deturnarea DLL-urilor?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>DLL-urile sunt biblioteci dinamice utilizate de Windows \u0219i de numeroase aplica\u021bii pentru a furniza func\u021bii necesare programelor.<\/p>\n\n\n\n<p>\u00cen anumite situa\u021bii, un executabil caut\u0103 bibliotecile DLL necesare \u00eentr-o anumit\u0103 loca\u021bie. Atacatorii pot exploata acest comportament plas\u00e2nd o bibliotec\u0103 mali\u021bioas\u0103 \u00eentr-un loc \u00een care aceasta va fi \u00eenc\u0103rcat\u0103 \u00een locul componentei a\u0219teptate.<\/p>\n\n\n\n<p>\u00cen campania TerminalFix, executabilul legitim&nbsp;<strong>LockScreenContentServer.exe<\/strong>&nbsp;este folosit pentru a \u00eenc\u0103rca biblioteca mali\u021bioas\u0103&nbsp;<p class=\"command\"><code>dui70.dll<\/code><\/p>.<\/p>\n\n\n\n<p>Aceast\u0103 metod\u0103 este important\u0103 deoarece permite atacatorului s\u0103 ascund\u0103 execu\u021bia codului mali\u021bios \u00een spatele unui fi\u0219ier legitim. Prin urmare, simpla verificare a faptului c\u0103 un executabil este semnat digital nu este \u00eentotdeauna suficient\u0103 pentru a identifica un atac.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Steganografia_ascunde_componentele_malitioase_in_imagini\"><\/span>Steganografia ascunde componentele mali\u021bioase \u00een imagini<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Dup\u0103 \u00eenc\u0103rcarea DLL-ului mali\u021bios, atacul continu\u0103 cu desc\u0103rcarea unor imagini PNG. La prima vedere, aceste fi\u0219iere par imagini obi\u0219nuite. \u00cen realitate, ele con\u021bin date ascunse care sunt extrase ulterior de programul mali\u021bios.<\/p>\n\n\n\n<p>Tehnica se nume\u0219te&nbsp;<strong>steganografie<\/strong>&nbsp;\u0219i presupune ascunderea unor informa\u021bii \u00eentr-un fi\u0219ier aparent normal, astfel \u00eenc\u00e2t con\u021binutul ascuns s\u0103 nu fie evident la o inspec\u021bie obi\u0219nuit\u0103.<\/p>\n\n\n\n<p>Microsoft arat\u0103 c\u0103 aceast\u0103 etap\u0103 face parte dintr-un lan\u021b mai amplu de evitare a detect\u0103rii, care include \u0219i utilizarea unor fi\u0219iere legitime, deturnarea DLL-urilor \u0219i directoare ascunse.<\/p>\n\n\n\n<p>Pentru echipele de securitate, acest comportament este relevant deoarece analiza trebuie s\u0103 urm\u0103reasc\u0103 nu doar tipul fi\u0219ierului, ci \u0219i&nbsp;<strong>modul \u00een care este utilizat<\/strong>.<\/p>\n\n\n\n<p>O imagine PNG desc\u0103rcat\u0103 de un browser este un lucru obi\u0219nuit. O imagine desc\u0103rcat\u0103 de un program PowerShell, urmat\u0103 de citirea datelor ascunse din ea \u0219i transformarea acestora \u00eentr-o component\u0103 executabil\u0103, reprezint\u0103 cu totul alt tip de comportament.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"TerminalFix_isi_asigura_persistenta_pe_sistem\"><\/span>TerminalFix \u00ee\u0219i asigur\u0103 persisten\u021ba pe sistem<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Campania nu se bazeaz\u0103 pe o singur\u0103 execu\u021bie. Microsoft a identificat dou\u0103 mecanisme utilizate pentru men\u021binerea accesului pe sistem:<\/p>\n\n\n\n<ul><li>cheile&nbsp;<strong>Registry Run<\/strong>;<\/li><li>activit\u0103\u021bi programate \u00een Windows.<\/li><\/ul>\n\n\n\n<p>Aceste mecanisme permit lansarea automat\u0103 a componentelor mali\u021bioase.<\/p>\n\n\n\n<p>Folosirea mai multor metode de persisten\u021b\u0103 cre\u0219te rezisten\u021ba atacului. Eliminarea unei singure componente nu garanteaz\u0103 c\u0103 programul mali\u021bios nu va fi lansat din nou.<\/p>\n\n\n\n<p>Pentru administratorii IT \u0219i echipele de securitate, modific\u0103rile nea\u0219teptate ale cheilor Registry asociate pornirii automate \u0219i apari\u021bia unor activit\u0103\u021bi programate necunoscute ar trebui investigate.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Atacatorii_executa_o_recunoastere_a_retelei_si_a_domeniului\"><\/span>Atacatorii execut\u0103 o recunoa\u0219tere a re\u021belei \u0219i a domeniului<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Un aspect important al campaniei TerminalFix este faptul c\u0103 atacul nu se opre\u0219te la calculatorul infectat. Dup\u0103 compromiterea sistemului, atacatorii execut\u0103 o&nbsp;<strong>recunoa\u0219tere a mediului informatic<\/strong>.<\/p>\n\n\n\n<p>Programul mali\u021bios colecteaz\u0103 informa\u021bii despre domeniu, utilizatori, calculatoare \u0219i servere. Microsoft men\u021bioneaz\u0103, printre altele:<\/p>\n\n\n\n<ul><li>identificarea conexiunilor clasificate ca fiind \u201ede incredere\u201d dintre domenii;<\/li><li>identificarea grupurilor cu privilegii de administrator;<\/li><li>enumerarea calculatoarelor din Active Directory;<\/li><li>enumerarea utilizatorilor;<\/li><li>colectarea descrierilor conturilor;<\/li><li>identificarea serverelor;<\/li><li>verificarea conectivit\u0103\u021bii c\u0103tre anumite servere;<\/li><li>colectarea informa\u021biilor despre sistemul compromis.<\/li><\/ul>\n\n\n\n<p>Aceast\u0103 etap\u0103 este esen\u021bial\u0103 pentru atacator deoarece \u00eei permite s\u0103 \u00een\u021beleag\u0103 structura re\u021belei. Cu alte cuvinte, calculatorul infectat devine un punct de observa\u021bie din interiorul organiza\u021biei.<\/p>\n\n\n\n<p>Atacatorul poate afla ce domenii exist\u0103, ce calculatoare sunt conectate, ce utilizatori \u0219i grupuri au privilegii \u0219i c\u0103tre ce servere poate exista acces.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Tunelul_invers_poate_transforma_calculatorul_compromis_intr-o_poarta_catre_retea\"><\/span>Tunelul invers poate transforma calculatorul compromis \u00eentr-o poart\u0103 c\u0103tre re\u021bea<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Cea mai important\u0103 component\u0103 a campaniei este&nbsp;<strong>tunelul invers<\/strong>. Microsoft a identificat un program bazat pe Python care este lansat f\u0103r\u0103 o fereastr\u0103 vizibil\u0103 \u0219i stabile\u0219te o conexiune c\u0103tre infrastructura atacatorilor printr-un canal WebSocket criptat.<\/p>\n\n\n\n<p>\u00cen analiza Microsoft, conexiunea observat\u0103 se realizeaz\u0103 c\u0103tre&nbsp;<p class=\"command\"><code>gitnow[.]dev:443<\/code><\/p>.<\/p>\n\n\n\n<p>Prin aceast\u0103 conexiune, atacatorul poate transmite trafic TCP prin calculatorul compromis. Sistemul infectat func\u021bioneaz\u0103 astfel ca un intermediar \u00eentre infrastructura atacatorului \u0219i resursele accesibile din re\u021beaua victimei.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"Ce_este_un_tunel_invers\"><\/span>Ce este un tunel invers?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>\u00centr-o situa\u021bie obi\u0219nuit\u0103, un server aflat \u00een interiorul unei re\u021bele corporative poate s\u0103 nu fie accesibil direct de pe internet.<\/p>\n\n\n\n<p>Tunelul invers schimb\u0103 aceast\u0103 situa\u021bie. \u00cen loc ca atacatorul s\u0103 ini\u021bieze direct o conexiune c\u0103tre serverul intern, calculatorul compromis ini\u021biaz\u0103 conexiunea c\u0103tre infrastructura atacatorului.<\/p>\n\n\n\n<p>Ulterior, aceast\u0103 conexiune poate fi folosit\u0103 pentru a transporta trafic c\u0103tre alte sisteme accesibile din re\u021beaua intern\u0103. Prin urmare, calculatorul infectat poate deveni un&nbsp;<strong>punct pivotant al re\u021belei<\/strong>.<\/p>\n\n\n\n<p>Aceast\u0103 caracteristic\u0103 face ca TerminalFix s\u0103 fie mult mai periculos dec\u00e2t un atac care urm\u0103re\u0219te exclusiv furtul de informa\u021bii de pe calculatorul ini\u021bial.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"De_ce_este_periculos_accesul_prin_tunel\"><\/span>De ce este periculos accesul prin tunel?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Imagineaz\u0103-\u021bi o organiza\u021bie \u00een care un calculator al unui angajat poate comunica cu servere interne care nu sunt accesibile direct de pe internet.<\/p>\n\n\n\n<p>Dac\u0103 acel calculator este compromis \u0219i atacatorul stabile\u0219te un tunel invers, conexiunea existent\u0103 a calculatorului poate fi exploatat\u0103 pentru a ajunge indirect la acele sisteme.<\/p>\n\n\n\n<p>Astfel, compromiterea unui singur calculator poate reprezenta \u00eenceputul unui atac mai amplu asupra infrastructurii.<\/p>\n\n\n\n<p>Microsoft precizeaz\u0103 \u00eens\u0103 un aspect important:&nbsp;<strong>nu a observat \u00een cadrul lan\u021bului analizat ac\u021biunile ulterioare pe care acest acces le-ar putea permite<\/strong>.<\/p>\n\n\n\n<p>Prin urmare, posibilitatea tehnic\u0103 de acces la alte sisteme nu trebuie confundat\u0103 cu dovada c\u0103 aceste ac\u021biuni au fost efectiv realizate \u00een cazul analizat.<\/p>\n\n\n\n<p>Totu\u0219i, organiza\u021biile afectate ar trebui s\u0103 trateze calculatoarele compromise ca posibile puncte de pivotare \u0219i s\u0103 verifice comportamentul lor \u00een re\u021bea sau dac\u0103 exist\u0103 expuneri de creden\u021biale.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"TerminalFix_comparat_cu_atacurile_ClickFix_obisnuite\"><\/span>TerminalFix comparat cu atacurile ClickFix obi\u0219nuite<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>TerminalFix porne\u0219te de la aceea\u0219i idee de baz\u0103 ca atacurile ClickFix: utilizatorul este manipulat s\u0103 execute o comand\u0103 prezentat\u0103 drept o opera\u021biune legitim\u0103.<\/p>\n\n\n\n<p><strong>Diferen\u021bele apar \u00een etapa urm\u0103toare.<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><th>ClickFix obi\u0219nuit<\/th><th>TerminalFix<\/th><\/tr><tr><td>Folose\u0219te ingineria social\u0103<\/td><td>Folose\u0219te ingineria social\u0103<\/td><\/tr><tr><td>Poate afi\u0219a un CAPTCHA fals<\/td><td>Folose\u0219te un CAPTCHA fals care imit\u0103 Cloudflare<\/td><\/tr><tr><td>Determin\u0103 utilizatorul s\u0103 execute o comand\u0103<\/td><td>Determin\u0103 utilizatorul s\u0103 execute o comand\u0103 PowerShell<\/td><\/tr><tr><td>Se bazeaz\u0103 frecvent pe Windows Run<\/td><td>Folose\u0219te Windows Terminal sau PowerShell<\/td><\/tr><tr><td>Poate livra un program pentru furtul de informa\u021bii<\/td><td>Folose\u0219te un lan\u021b de atac \u00een mai multe etape<\/td><\/tr><tr><td>Impactul poate r\u0103m\u00e2ne la nivelul calculatorului<\/td><td>Calculatorul poate deveni un punct de acces c\u0103tre re\u021bea<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Microsoft subliniaz\u0103 tocmai aceast\u0103 diferen\u021b\u0103: campania TerminalFix nu se limiteaz\u0103 la livrarea unui singur program destinat furtului de informa\u021bii, ci combin\u0103 mai multe tehnici pentru a ob\u021bine acces persistent \u0219i posibilitatea de a comunica cu sisteme din re\u021beaua intern\u0103.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Cum_se_pot_proteja_organizatiile_impotriva_atacurilor_TerminalFix\"><\/span>Cum se pot proteja organiza\u021biile \u00eempotriva atacurilor TerminalFix?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Protec\u021bia \u00eempotriva acestui tip de amenin\u021bare trebuie s\u0103 includ\u0103 at\u00e2t m\u0103suri tehnice, c\u00e2t \u0219i instruirea utilizatorilor.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"1_Nu_permiteti_utilizatorilor_sa_execute_comenzi_primite_de_pe_pagini_web\"><\/span>1. Nu permite\u021bi utilizatorilor s\u0103 execute comenzi primite de pe pagini web<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Un utilizator nu ar trebui s\u0103 copieze \u0219i s\u0103 execute o comand\u0103 PowerShell doar pentru a trece de un CAPTCHA.<\/p>\n\n\n\n<p>Aceasta este una dintre cele mai simple reguli de ap\u0103rare \u00eempotriva tehnicii ClickFix.<\/p>\n\n\n\n<p><strong>Un CAPTCHA legitim nu cere utilizatorului s\u0103 deschid\u0103 PowerShell, Windows Terminal sau linia de comand\u0103 \u0219i s\u0103 execute o instruc\u021biune furnizat\u0103 de site.<\/strong><\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"2_Limitati_utilizarea_PowerShell_acolo_unde_este_posibil\"><\/span>2. Limita\u021bi utilizarea PowerShell acolo unde este posibil<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Organiza\u021biile ar trebui s\u0103 evalueze ce utilizatori \u0219i aplica\u021bii au nevoie de acces la PowerShell \u0219i Windows Terminal.<\/p>\n\n\n\n<p>Acolo unde este posibil, utilizarea unor mecanisme precum&nbsp;<strong>AppLocker, Windows Application Control \u0219i Group Policy<\/strong>&nbsp;poate reduce posibilit\u0103\u021bile de execu\u021bie neautorizat\u0103.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"3_Monitorizati_deturnarea_DLL-urilor_DLL_Sideloading\"><\/span>3. Monitoriza\u021bi deturnarea DLL-urilor (DLL Sideloading)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Echipele de securitate ar trebui s\u0103 urm\u0103reasc\u0103 situa\u021biile \u00een care un executabil legitim \u00eencarc\u0103 biblioteci DLL din loca\u021bii neobi\u0219nuite.<\/p>\n\n\n\n<p>O combina\u021bie precum:<\/p>\n\n\n\n<p><strong>executabil legitim + DLL necunoscut + loca\u021bie neobi\u0219nuit\u0103<\/strong><\/p>\n\n\n\n<p>poate reprezenta un indicator important pentru investiga\u021bie.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"4_Monitorizati_modificarile_de_persistenta\"><\/span>4. Monitoriza\u021bi modific\u0103rile de persisten\u021b\u0103<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Trebuie urm\u0103rite \u00een special:<\/p>\n\n\n\n<ul><li>modific\u0103rile neobi\u0219nuite ale cheilor Registry Run;<\/li><li>activit\u0103\u021bile programate nou create;<\/li><li>executabile lansate din&nbsp;<p class=\"command\"><code>C:\\ProgramData<\/code><\/p>;<\/li><li>directoare ascunse nou ap\u0103rute;<\/li><li>procese Python lansate f\u0103r\u0103 interfa\u021b\u0103;<\/li><li>conexiuni WebSocket neobi\u0219nuite c\u0103tre infrastructur\u0103 extern\u0103.<\/li><\/ul>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"5_Monitorizati_recunoasterea_Active_Directory\"><\/span>5. Monitoriza\u021bi recunoa\u0219terea Active Directory<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>O sta\u021bie de lucru care \u00eencepe brusc s\u0103 enumere utilizatori, calculatoare, grupuri administrative, rela\u021bii de \u00eencredere \u0219i servere poate indica activitate mali\u021bioas\u0103.<\/p>\n\n\n\n<p>Nu orice opera\u021biune de enumerare este un atac, \u00eens\u0103 schimbarea brusc\u0103 a comportamentului unui calculator trebuie investigat\u0103 \u00een context.<\/p>\n\n\n\n<h3><span class=\"ez-toc-section\" id=\"6_Instruiti_angajatii\"><\/span>6. Instrui\u021bi angaja\u021bii<span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p>Instruirea utilizatorilor r\u0103m\u00e2ne una dintre cele mai eficiente m\u0103suri \u00eempotriva tehnicii ClickFix.<\/p>\n\n\n\n<p>Angaja\u021bii trebuie s\u0103 \u0219tie c\u0103:&nbsp;<strong>nu trebuie s\u0103 copieze \u0219i s\u0103 execute comenzi \u00een PowerShell, Windows Terminal sau Command Prompt doar pentru a trece de o verificare CAPTCHA, pentru a repara o problem\u0103 sau pentru a activa o func\u021bie a unui site.<\/strong><\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Ce_inseamna_TerminalFix_pentru_securitatea_companiilor\"><\/span>Ce \u00eenseamn\u0103 TerminalFix pentru securitatea companiilor?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Atacurile de tip TerminalFix arat\u0103 cum o tehnic\u0103 relativ simpl\u0103 de&nbsp;<a href=\"https:\/\/www.interlink.ro\/blog\/securitate-online-cum-iti-protejezi-datele\" target=\"_blank\" rel=\"noreferrer noopener\">inginerie social\u0103<\/a>&nbsp;poate fi transformat\u0103 \u00eentr-un atac complex asupra infrastructurii unei organiza\u021bii.<\/p>\n\n\n\n<p>Ingineria social\u0103 permite accesul ini\u021bial. PowerShell permite desc\u0103rcarea componentelor. Deturnarea DLL-urilor \u0219i steganografia ajut\u0103 la ascunderea activit\u0103\u021bii. Mecanismele de persisten\u021b\u0103 permit men\u021binerea accesului. Recunoa\u0219terea infrastructurii ofer\u0103 informa\u021bii despre re\u021bea, iar tunelul invers poate transforma calculatorul compromis \u00eentr-un punct de acces c\u0103tre alte sisteme.<\/p>\n\n\n\n<h2><span class=\"ez-toc-section\" id=\"Ce_trebuie_retinut_despre_TerminalFix\"><\/span>Ce trebuie re\u021binut despre TerminalFix<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p>Pentru utilizatori, lec\u021bia este simpl\u0103: nu executa\u021bi niciodat\u0103 comenzi primite de pe o pagin\u0103 web doar pentru a demonstra c\u0103 sunte\u021bi oameni. Pentru organiza\u021bii, campania reprezint\u0103 \u00eenc\u0103 un argument pentru monitorizarea atent\u0103 a activit\u0103\u021bii de pe sta\u021biile de lucru \u0219i a conexiunilor c\u0103tre infrastructura intern\u0103.<\/p>\n\n\n\n<p><strong>Sursa informa\u021biilor:<\/strong>&nbsp;<a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2026\/08\/28\/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion\/\" target=\"_blank\" rel=\"noreferrer noopener\">microsoft.com<\/a><\/p>\n\t<div class=\"quickshare-container\">\r\n\t<ul class=\"quickshare-icons quickshare-effect-expand quickshare-small\">\r\n\t\t<li class=\"quickshare-share\">Distribuie:<\/li> \r\n\t\t<li><a href=\"https:\/\/facebook.com\/sharer.php?u=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;t=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape+<+Blog+Interlink\" target=\"_blank\" title=\"Share on Facebook\"><span class=\"quickshare-facebook\">Facebook<\/span><\/a><\/li>\t\t<li><a href=\"https:\/\/twitter.com\/intent\/tweet?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;text=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape+<+Blog+Interlink&amp;via=interlinkro\" target=\"_blank\" title=\"Share on Twitter\"><span class=\"quickshare-twitter\">Twitter<\/span><\/a><\/li>\t\t<li><a href=\"http:\/\/pinterest.com\/pin\/create\/button\/?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;media=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fwp-content%2Fuploads%2F2026%2F09%2FTerminalFix-un-atac-cibernetic-sofisticat-300x200.png&amp;description=Cercet%C4%83torii+Microsoft+au+identificat+o+nou%C4%83+campanie+de+atacuri+cibernetice+denumit%C4%83%26nbsp%3BTerminalFix%2C+o+variant%C4%83+a+ClickFix+care+vizeaz%C4%83+organiza%C8%9Bii+din+mai+multe+domenii.+Atacul+folose%C8%99te+site-uri+compromise+pentru+a+afi%C8%99a+utilizatorilor+un+CAPTCHA+fals%2C+asem%C4%83n%C4%83tor+mecanismului+Cloudflare+Turnstile%2C+%C8%99i+%C3%AEi+convinge%26hellip%3B\" target=\"_blank\" title=\"Share on Pinterest\"><span class=\"quickshare-pinterest\">Pinterest<\/span><\/a><\/li>\t\t<li><a href=\"http:\/\/linkedin.com\/shareArticle?mini=true&amp;url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;title=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape&amp;source=Blog+Interlink&amp;summary=Cercet%C4%83torii+Microsoft+au+identificat+o+nou%C4%83+campanie+de+atacuri+cibernetice+denumit%C4%83%26nbsp%3BTerminalFix%2C+o+variant%C4%83+a+ClickFix+care+vizeaz%C4%83+organiza%C8%9Bii+din+mai+multe+domenii.+Atacul+folose%C8%99te+site-uri+compromise+pentru+a+afi%C8%99a+utilizatorilor+un+CAPTCHA+fals%2C+asem%C4%83n%C4%83tor+mecanismului+Cloudflare+Turnstile%2C+%C8%99i+%C3%AEi+convinge%26hellip%3B\" title=\"Share on Linkedin\" target=\"_blank\"><span class=\"quickshare-linkedin\">Linkedin<\/span><\/a><\/li>\t\t<li><a href=\"https:\/\/plus.google.com\/share?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\" target=\"_blank\" title=\"Share on Google+\"><span class=\"quickshare-googleplus\">Google+<\/span><\/a><\/li>\t\t<li><a href=\"http:\/\/tumblr.com\/share\/link?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;name=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape+<+Blog+Interlink&amp;description=Cercet%C4%83torii+Microsoft+au+identificat+o+nou%C4%83+campanie+de+atacuri+cibernetice+denumit%C4%83%26nbsp%3BTerminalFix%2C+o+variant%C4%83+a+ClickFix+care+vizeaz%C4%83+organiza%C8%9Bii+din+mai+multe+domenii.+Atacul+folose%C8%99te+site-uri+compromise+pentru+a+afi%C8%99a+utilizatorilor+un+CAPTCHA+fals%2C+asem%C4%83n%C4%83tor+mecanismului+Cloudflare+Turnstile%2C+%C8%99i+%C3%AEi+convinge%26hellip%3B\" title=\"Share on Tumblr\" target=\"_blank\"><span class=\"quickshare-tumblr\">Tumblr<\/span><\/a><\/li>\t\t<li><a href=\"http:\/\/reddit.com\/submit?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;title=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape+<+Blog+Interlink\" title=\"Submit to Reddit\" target=\"_blank\"><span class=\"quickshare-reddit\">Reddit<\/span><\/a><\/li>\t\t<li><a href=\"http:\/\/stumbleupon.com\/submit?url=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape&amp;title=TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape+<+Blog+Interlink\" target=\"_blank\" title=\"Share on StumbleUpon\"><span class=\"quickshare-stumbleupon\">Stumble Upon<\/span><\/a><\/li>\t\t<li><a href=\"mailto:?subject=Blog+Interlink:+TerminalFix%3A+un+atac+cibernetic+sofisticat%2C+%C3%AEn+mai+multe+etape&amp;body=https%3A%2F%2Fwww.interlink.ro%2Fblog%2Fterminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\" target=\"_blank\" title=\"Share via Email\"><span class=\"quickshare-email\">Email<\/span><\/a><\/li>\t<\/ul>\r\n\t<\/div>\r\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\">Timp de citit: <\/span> <span class=\"rt-time\"> 6<\/span> <span class=\"rt-label rt-postfix\">minutes<\/span><\/span>Cercet\u0103torii Microsoft au identificat o nou\u0103 campanie de atacuri cibernetice denumit\u0103&nbsp;TerminalFix, o variant\u0103 a ClickFix care vizeaz\u0103 organiza\u021bii din mai multe domenii. Atacul folose\u0219te site-uri compromise pentru a afi\u0219a utilizatorilor un CAPTCHA fals, asem\u0103n\u0103tor mecanismului Cloudflare Turnstile, \u0219i \u00eei convinge s\u0103 copieze \u0219i s\u0103 execute o comand\u0103 PowerShell. La prima vedere, utilizatorul pare s\u0103 efectueze &hellip; <a href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape<\/span><\/a><\/p>\n","protected":false},"author":11805,"featured_media":7040,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[26],"tags":[4244,4884,4883,1640,2800,4882],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.8 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape - Interlink.ro<\/title>\n<meta name=\"description\" content=\"TerminalFix: Microsoft avertizeaz\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\u021bie PowerShell \u0219i tunel invers.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape - Interlink.ro\" \/>\n<meta property=\"og:description\" content=\"TerminalFix: Microsoft avertizeaz\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\u021bie PowerShell \u0219i tunel invers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\" \/>\n<meta property=\"og:site_name\" content=\"Blog Interlink\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/facebook.com\/interlinksrl\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-04T06:28:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-04T06:28:27+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png\" \/>\n\t<meta property=\"og:image:width\" content=\"720\" \/>\n\t<meta property=\"og:image:height\" content=\"480\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alexandru C\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/#organization\",\"name\":\"INTERLINK GROUP SRL\",\"url\":\"https:\/\/www.interlink.ro\/blog\/\",\"sameAs\":[\"http:\/\/facebook.com\/interlinksrl\"],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2022\/02\/logo.png\",\"contentUrl\":\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2022\/02\/logo.png\",\"width\":175,\"height\":76,\"caption\":\"INTERLINK GROUP SRL\"},\"image\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/#website\",\"url\":\"https:\/\/www.interlink.ro\/blog\/\",\"name\":\"Blog Interlink\",\"description\":\"Stiri It, Informatii, Anunturi, Produse\",\"publisher\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.interlink.ro\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png\",\"contentUrl\":\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png\",\"width\":720,\"height\":480,\"caption\":\"TerminalFix - un atac cibernetic sofisticat\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage\",\"url\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\",\"name\":\"TerminalFix: un atac cibernetic sofisticat, \\u00een mai multe etape - Interlink.ro\",\"isPartOf\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage\"},\"datePublished\":\"2026-09-04T06:28:25+00:00\",\"dateModified\":\"2026-09-04T06:28:27+00:00\",\"description\":\"TerminalFix: Microsoft avertizeaz\\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\\u021bie PowerShell \\u0219i tunel invers.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.interlink.ro\/blog\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Produse\",\"item\":\"https:\/\/www.interlink.ro\/blog\/category\/produse\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"TerminalFix: un atac cibernetic sofisticat, \\u00een mai multe etape\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage\"},\"author\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/#\/schema\/person\/126d8be5dc3dc73c4ff3e4ec6a6a627f\"},\"headline\":\"TerminalFix: un atac cibernetic sofisticat, \\u00een mai multe etape\",\"datePublished\":\"2026-09-04T06:28:25+00:00\",\"dateModified\":\"2026-09-04T06:28:27+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage\"},\"wordCount\":2040,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png\",\"keywords\":[\"atac cibernetic\",\"CAPTCHA Fals\",\"ClickFix\",\"malware\",\"securitate cibernetic\\u0103\",\"TerminalFix\"],\"articleSection\":[\"Produse\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#respond\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/#\/schema\/person\/126d8be5dc3dc73c4ff3e4ec6a6a627f\",\"name\":\"Alexandru C\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.interlink.ro\/blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4798bc5da087bb02d31f0a4c0712c3c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4798bc5da087bb02d31f0a4c0712c3c?s=96&d=mm&r=g\",\"caption\":\"Alexandru C\"},\"url\":\"https:\/\/www.interlink.ro\/blog\/author\/alexandruc\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape - Interlink.ro","description":"TerminalFix: Microsoft avertizeaz\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\u021bie PowerShell \u0219i tunel invers.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape","og_locale":"en_US","og_type":"article","og_title":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape - Interlink.ro","og_description":"TerminalFix: Microsoft avertizeaz\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\u021bie PowerShell \u0219i tunel invers.","og_url":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape","og_site_name":"Blog Interlink","article_publisher":"http:\/\/facebook.com\/interlinksrl","article_published_time":"2026-09-04T06:28:25+00:00","article_modified_time":"2026-09-04T06:28:27+00:00","og_image":[{"width":720,"height":480,"url":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png","type":"image\/png"}],"twitter_misc":{"Written by":"Alexandru C","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.interlink.ro\/blog\/#organization","name":"INTERLINK GROUP SRL","url":"https:\/\/www.interlink.ro\/blog\/","sameAs":["http:\/\/facebook.com\/interlinksrl"],"logo":{"@type":"ImageObject","@id":"https:\/\/www.interlink.ro\/blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2022\/02\/logo.png","contentUrl":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2022\/02\/logo.png","width":175,"height":76,"caption":"INTERLINK GROUP SRL"},"image":{"@id":"https:\/\/www.interlink.ro\/blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.interlink.ro\/blog\/#website","url":"https:\/\/www.interlink.ro\/blog\/","name":"Blog Interlink","description":"Stiri It, Informatii, Anunturi, Produse","publisher":{"@id":"https:\/\/www.interlink.ro\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.interlink.ro\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"ImageObject","@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage","inLanguage":"en-US","url":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png","contentUrl":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png","width":720,"height":480,"caption":"TerminalFix - un atac cibernetic sofisticat"},{"@type":"WebPage","@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage","url":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape","name":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape - Interlink.ro","isPartOf":{"@id":"https:\/\/www.interlink.ro\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage"},"datePublished":"2026-09-04T06:28:25+00:00","dateModified":"2026-09-04T06:28:27+00:00","description":"TerminalFix: Microsoft avertizeaz\u0103 asupra unui nou atac de tip ClickFix cu CAPTCHA fals, execu\u021bie PowerShell \u0219i tunel invers.","breadcrumb":{"@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.interlink.ro\/blog"},{"@type":"ListItem","position":2,"name":"Produse","item":"https:\/\/www.interlink.ro\/blog\/category\/produse"},{"@type":"ListItem","position":3,"name":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape"}]},{"@type":"Article","@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#article","isPartOf":{"@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage"},"author":{"@id":"https:\/\/www.interlink.ro\/blog\/#\/schema\/person\/126d8be5dc3dc73c4ff3e4ec6a6a627f"},"headline":"TerminalFix: un atac cibernetic sofisticat, \u00een mai multe etape","datePublished":"2026-09-04T06:28:25+00:00","dateModified":"2026-09-04T06:28:27+00:00","mainEntityOfPage":{"@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#webpage"},"wordCount":2040,"commentCount":0,"publisher":{"@id":"https:\/\/www.interlink.ro\/blog\/#organization"},"image":{"@id":"https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#primaryimage"},"thumbnailUrl":"https:\/\/www.interlink.ro\/blog\/wp-content\/uploads\/2026\/09\/TerminalFix-un-atac-cibernetic-sofisticat.png","keywords":["atac cibernetic","CAPTCHA Fals","ClickFix","malware","securitate cibernetic\u0103","TerminalFix"],"articleSection":["Produse"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.interlink.ro\/blog\/terminalfix-un-atac-cibernetic-sofisticat-in-mai-multe-etape#respond"]}]},{"@type":"Person","@id":"https:\/\/www.interlink.ro\/blog\/#\/schema\/person\/126d8be5dc3dc73c4ff3e4ec6a6a627f","name":"Alexandru C","image":{"@type":"ImageObject","@id":"https:\/\/www.interlink.ro\/blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/c4798bc5da087bb02d31f0a4c0712c3c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4798bc5da087bb02d31f0a4c0712c3c?s=96&d=mm&r=g","caption":"Alexandru C"},"url":"https:\/\/www.interlink.ro\/blog\/author\/alexandruc"}]}},"_links":{"self":[{"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/posts\/7037"}],"collection":[{"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/users\/11805"}],"replies":[{"embeddable":true,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/comments?post=7037"}],"version-history":[{"count":3,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/posts\/7037\/revisions"}],"predecessor-version":[{"id":7049,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/posts\/7037\/revisions\/7049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/media\/7040"}],"wp:attachment":[{"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/media?parent=7037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/categories?post=7037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.interlink.ro\/blog\/wp-json\/wp\/v2\/tags?post=7037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}