Hello and welcome to the Wednesday, November 19th, 2025 edition of the Sands-inand-Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the sands.edu undergraduate certificate program

in Cybersecurity Fundamentals.

Brad Duncan today published another diary with yet another variant of ClickFix.

ClickFix, the Captcha lookalike that tricks victims into copy pastasting PowerShell commands into their Windows command line.

Well, in this particular case, it's going to lead you to install Kong Tuk or Konduk,

not sure how to pronounce it, but this is an example of a traffic direction system or TDS.

This type of malware is a little bit different than what you often have, like Info Steelers or such.

The main purpose of TDS systems is to give the attacker a platform to redirect their traffic.

So these are typically proxies and the like that will just forward traffic for the attacker.

They can often be chained for additional obfuscation of the traffic.

And then the networks being created by the attacker are often also rented out to other attackers. So it's sort of a

basic fundamental part of this criminal underground economy. And a couple weeks ago, I myself

counted myself lucky because the Inland Storm Center website did not use AWS, which had its big outage a couple weeks ago.

Well, this morning I wasn't that lucky. We had a big outage of Cloudflare. Cloudflare stopped working for a few hours in the morning, at least the East Coast time in the morning, probably Europe or UTC.

It was more the afternoon when this outage happened, and it took them quite a while to get

things back up and going. Given the scale of Cloudflare, and I don't have the current

numbers handy, but I remember something like 30% of websites or traffic going

through Cloudflare, which seems plausible. There were a lot of large websites other than

Internet Storm Center that were affected by this, like for example, X and many of the AI chatbots, for example, chat GPT, but also Anthropic had some issues

because they are behind Cloudflare.

...