SmartApeSGMalware
- HANEYMANEY
- zphp
According to Proofpoint, this is a cluster of fake update campaigns delivering payloads like NetSupportManager RAT and Lumma Stealer.From MISP Galaxy
Last reported 1 month ago, by Sekoia.io3 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1684Social Engineering
“Despite @Exvicy’s public claims that this framework is a distinct product because the ClickFix social engineering lure relies on the “Win+R” shortcut instead of “Win+X”, technical analysis revealed several similarities with ErrTraffic.”
- T1219Remote Access Tools
“Deploy remote access tools or information stealers.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework“It became a leading competition among ClickFix distribution clusters, alongside ClearFake, KongTuke, SmartApeSG, and IClickFix.”
-
SmartApeSG Launches Okendo Reviews Supply Chain Attack“SmartApeSG Launches Okendo Reviews Supply Chain Attack”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“License keys: Cracked versions often use bizarre license strings such as licensees named NSM1234 or HANEYMANEY.”
Indicators in its reports
named in the reports above- remotedesktop[.]comin 1 report
- syncroapi[.]comin 1 report
- kabutoservices[.]comin 1 report
- hxxps://server.rarexterna[.]top/Bin/ScreenConnect.ClientSetup.msiin 1 report
- server.rarexterna[.]topin 1 report
- pdq[.]comin 1 report
- lolrmm[.]ioin 1 report
- hxxp://cdn-static.okendo[.]io/reviews-widget-plus/js/okendo-reviews.jsin 1 report
- cdn-static.okendo[.]ioin 1 report
- hxxps://api.wigetticks[.]com/logout/private-response.php?8D1V4th3in 1 report
- api.wigetticks[.]comin 1 report
- hxxps://api.wizzleticks[.]com/claims/scope-schema.php?4ManBBdAin 1 report
- api.wizzleticks[.]comin 1 report
- cloudflarecapcha[.]comin 1 report
- perfectverified[.]comin 1 report
- newsecuredevice[.]comin 1 report
- unitedstateverif[.]comin 1 report
- hxxps://us-addnewdevice[.]com/panelin 1 report
- us-addnewdevice[.]comin 1 report
- hxxps://us-addnewdevice[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.