Loading malware…
NetSupport Manager RAT refers to malicious deployments of NetSupport Manager, a legitimate remote administration product repurposed by attackers to obtain unauthorized remote control of Windows systems. It is used as both an initial remote-access payload and a follow-on tool in multistage intrusions. Its use is not exclusive to a single threat actor or campaign.
Delivery mechanisms include phishing messages with malicious Office documents, targeted social-media messages, deceptive document-sharing workflows, and ClickFix fake verification pages that persuade victims to execute commands manually. Malicious MSIX installers impersonating legitimate applications have also delivered it through campaigns using malvertising and SEO poisoning. NetSupport Manager RAT has appeared as a follow-on payload in Hancitor infections and in chains involving POWERTRASH and Carbanak. SmartApeSG campaigns have installed malicious NetSupport packages after an initial RAT infection. It has also been deployed following exploitation of Microsoft Exchange servers.
Observed deployments establish command-and-control communications, including HTTP requests and connections over TCP port 443. Some instances perform an external IP-location check and identify NetSupport Manager in HTTP request headers. Installation scripts in SmartApeSG infections configure automatic execution after system restarts and delete staging artifacts. Other delivery chains check for malware-analysis tools before extracting the remote-access package; these checks belong to the surrounding infection chain rather than necessarily to NetSupport itself.
NetSupport Manager RAT has been used in REF9019 intrusions associated with Cuba ransomware against North American and European retailers and manufacturers, and in MSIX activity associated with FIN7, also tracked as Sangria Tempest. Other campaigns have targeted hotel and accommodation personnel and cybersecurity conference participants. Its deployment spans multiple industries and includes opportunistic as well as targeted attacks.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Our sample is the NetSupportManager RAT"; it was named ra.exe and written and executed by the previously exploited Exchange IIS worker process.
When victims open these MSIX packages, the StartingScriptWrapper.ps1 component launches embedded PowerShell scripts that employ process injection to execute POWERTRASH and Carbanak malware, which subsequently deliver NetSupport Manager RAT.
My previous in-depth diary about a SmartApeSG (ZPHP, HANEYMANEY) was in November 2025, when I saw NetSupport Manager RAT.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
MITRE ATT&CK Mapping Technique ID Context Obtain Capabilities: Tool T1588.002 Legitimate NetSupport Manager repurposed as RAT
MITRE ATT&CK Mapping Technique ID Context Obtain Capabilities: Digital Certificates T1588.004 Stolen/cracked NSM license (2015 vintage)
Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
This report details a specific phishing campaign used to distribute the Agent Tesla RAT. The lure in the emails is centered around updates to COVID-specific PPE.
MITRE ATT&CK Mapping Technique ID Context Phishing: Spearphishing Attachment T1566.001 Freight rate confirmation and government lure filenames
A batch script called token.bat handles the extraction and installation, while a VBScript file called processor.vbs triggers the batch script.
Defenders are advised to monitor for unusual PowerShell execution tied to browser events, as this is a clear sign of the ClickFix technique being abused.
A batch script called token.bat handles the extraction and installation... Together, these components install the NetSupport RAT and configure it to run automatically whenever the system restarts.
These are rather generic maldocs which contain obfuscated VB/Macros which retrieve a specially-crafted .PNG image file.
Stage 2 : Payload JavaScript exécuté en mémoire
The page copies a PowerShell command to the victim's clipboard and instructs them to press Win+R, Ctrl+V, Enter. Standard ClickFix technique -- the victim executes the malware themselves, bypassing email attachment scanning, download warnings, and Mark-of-the-Web protections.
Téléchargement manuel : GAPIUpdate.dmg depuis GitHub... Windows... ClickOnce : GapiUpdate.application... macOS → AMOS infostealer... Windows → DocsendInstaller.exe
Endpoint : alert on %LOCALAPPDATA%\NetService\ directory creation, on Service.exe running from non-standard paths, and on PCICL32.DLL sideloading events.
Creates a Startup folder LNK for persistence
Creates Client.lnk in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ via WScript.Shell COM object — T1547.001
fal.php drops NetSupport Manager 12.01 with a v10.60 loader stub, installs into %LOCALAPPDATA%\NetService\ , launches Service.exe through explorer.exe for PPID spoofing, and drops service.lnk into the Startup folder for persistence.
launches Service.exe via explorer.exe (PPID spoof)
launches Service.exe via explorer.exe (PPID spoof)
Creates a Startup folder LNK for persistence
Creates Client.lnk in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ via WScript.Shell COM object — T1547.001
fal.php drops NetSupport Manager 12.01 with a v10.60 loader stub, installs into %LOCALAPPDATA%\NetService\ , launches Service.exe through explorer.exe for PPID spoofing, and drops service.lnk into the Startup folder for persistence.
That loader uses variable indirection to construct the string iex : sv o ie # $o = 'ie' .((gv o).Value + 'X') # invoke ('ie' + 'X') = iex
MITRE ATT&CK Mapping Technique ID Context Obfuscated Files: Software Packing T1027.002 PyInstaller packing; XOR encryption with StagerKey16Bytes
a dual-lure NetSupport Manager RAT operation... A CS2 "Iridia Cheats" lure at iridiacheats.dev ... A "Polymarket Smart Money Scanner" whale-tracker lure at polymarketscanner.dev
s’est fait passer pour le VP Marketing de CoinDesk... faux DocSend ... forge un certificat pour www.virustotal.com ... fichiers DockerDesktopSvc.exe , SteamClientHelperHost.exe , TeraCopyMonMon.exe
After the NetSupport RAT is installed and made persistent on the host, the scripts used to set it up are deleted automatically, removing traces of the initial compromise.
launches Service.exe via explorer.exe (PPID spoof)
launches Service.exe via explorer.exe (PPID spoof)
fal.php drops NetSupport Manager 12.01 with a v10.60 loader stub, installs into %LOCALAPPDATA%\NetService\, launches Service.exe through explorer.exe for PPID spoofing
Hancitor first causes an IP address check to api.ipify.org by the infected Windows host.
Endpoint : alert on %LOCALAPPDATA%\NetService\ directory creation, on Service.exe running from non-standard paths, and on PCICL32.DLL sideloading events.
Hancitor first causes an IP address check to api.ipify.org by the infected Windows host.
downloads gggs.7z (pw: falos), lin.7z (pw: ilil), 7z.exe, 7z.dll
Hancitor C2 traffic consists of HTTP POST URLs that end with /8/forum.php . | The infected host first generates Hancitor command and control (C2) traffic.
Hancitor C2 traffic consists of HTTP POST URLs that end with /8/forum.php .
Payloads téléchargés : DockerDesktopSvc.exe , SteamClientHelperHost.exe , TeraCopyMonMon.exe ... Stage 3 : 3 payloads depuis eu03hub.com
In this case, we find indicators for NetSupport Manager RAT malware.
NetSupport Manager RAT (C2 : msedgewebview1.pro / msedgewebview2.pro:443, IP 87.120.104.88)
MITRE ATT&CK Mapping Technique ID Context Encrypted Channel: Asymmetric Crypto T1573.002 HTTPS C2 on port 443 (custom NSM protocol)
119 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.