NetSupportManager RATMalware
- NetSupport
Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns.From MISP Galaxy
Last reported 3 days ago, by Huntress25 reports
ATT&CK techniques
6 of 48 · each with the sentence it comes from- T1684Social Engineering
“…hat has already struck at least three Huntress customers, a threat actor using paid search results led victims into ClickFix-style social engineering that, as is usually the case, prompts the victims to run a command in their terminal.”
- T1036Masquerading
“Masquerading - Match Legitimate Name or Location”
- T1053.005Scheduled Task
“Their main difference is the use of different paths to download NetSupport components, registry keys, and scheduled tasks.”
- T1219Remote Access Tools
“Just one malicious command pasted into a Run box can open the door to infostealers, remote access tools, ransomware, or other malicious software.”
- T1055Process Injection
“This path has also been observed as a SpawnTo parameter in Cobalt Strike process injection configurations.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter (T1059)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
25 reports · the newest 20, newest first · the exact sentence from each-
Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware“…nger command kicks off a complex, multi-layered attack chain that ends with multiple payloads dropped, including a pirated copy of the NetSupport Client remote monitoring and management (RMM) tool and a version of Lumma Stealer.”
-
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes“…PTs or shared-AI chat content, which then redirect them to a fake Cloudflare verification page serving ClickFix-style lures to deliver NetSupport RAT.”
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures“Another build of the stealer has been found to install NetSupport Manager.”
-
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware“Payload one: NetSupport Manager”
-
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware“The macOS path delivered an AMOS infostealer, while the Windows path delivered NetSupport RAT, a Ledger wallet implant, and a traffic-intercepting proxy.”
-
AiTM Phishing Becomes Top Initial Access Threat to Law Firms“The technique primarily delivered NetSupportManager RAT, which alone accounted for 26.2% of all malware detections in the sector.”
-
SmartApeSG Launches Okendo Reviews Supply Chain Attack“SmartApeSG activity commonly leads to the deployment of remote access trojans (RATs) such as NetSupport and Remcos, or information stealers such as StealC.”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“They then use that first tool to push a second, more permanent remote access tool—usually a cracked version of NetSupport Manager or a specially configured ScreenConnect instance.”
-
Meet IClickFix: a widespread framework using the ClickFix tactic“Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“…es disguised as Word documents, displaying a fake error window that prompts users to install malware such as Matanbuchus, DarkGate, or NetSupport RAT via a PowerShell script.”
-
ClickFix Removes Your Background but Leaves the Malware“The chain delivers CastleLoader, which then drops both NetSupport RAT and a custom .NET stealer (We are calling it "CastleStealer", in the spirit of the franchise).”
-
A New RAT and a Hands-on-Keyboard Intrusion“…atanbuchus has been used to deliver a range of follow-on payloads, including Cobalt Strike, QakBot, DanaBot, Rhadamanthys stealer, and NetSupport RAT.”
-
Bloody Wolf: A Blunt Crowbar Threat To Justice“Later, the group switched to deploying the legitimate NetSupport remote administration tool (RAT) in campaigns targeting Kazakhstan and Russia previously described by BI.ZONE analysts.”
-
Deobfuscating Files for Flags: Huntress CTF 2025 Retro“NetSupport, Webshellz (by Ben Folland): Here, players could practice their digital forensics and malware analysis skills.”
-
141 Key Cybersecurity Statistics for 2026 and Beyond“Manufacturing environments saw high numbers of RAT installations in 2024, with AsyncRAT, Trickbot, NetSupport, and NewCoreRAT as the most frequently detected families.”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“The Center for Internet Security documented a trojanised build of NetSupport delivered inside an archive named update.zip, with a configuration file pointing at attacker infrastructure.”
-
Fake Browser Updates Lead to BOINC Volunteer Computing Software“RATs (such as AsyncRAT or NetSupport RAT) that provide Command and Control”
-
GHOSTPULSE haunts victims using defense evasion bag o' tricks“We have observed SectopRAT, Rhadamanthys, Vidar, Lumma, and NetSupport as final payloads.”
-
CUBA Ransomware Campaign Analysis“…uded the name, hash, and IP in our Observables table as the IP address (108.170.31.115) was also reported distributing ra.exe (see the NetSupport section below).”
-
Connecting the Bots“As a loader, it has been used to download other malware families, such as Ficker stealer and NetSupport RAT, to compromised hosts.”
Indicators in its reports
named in the reports above- eu03hub[.]comin 2 reports
- ai-scan[.]digitalin 1 report
- bg-transparency[.]onlinein 1 report
- cheeshomireciple[.]comin 1 report
- remotedesktop[.]comin 1 report
- syncroapi[.]comin 1 report
- kabutoservices[.]comin 1 report
- hxxps://server.rarexterna[.]top/Bin/ScreenConnect.ClientSetup.msiin 1 report
- server.rarexterna[.]topin 1 report
- pdq[.]comin 1 report
- lolrmm[.]ioin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.