Loading malware…
MaskBat is a custom obfuscated loader identified by Recorded Future Insikt Group and also referenced by CYFIRMA in activity associated with GrayAlpha, a threat cluster assessed to overlap with FIN7. Reporting states that MaskBat has similarities to FakeBat and contains strings linked to GrayAlpha. It is used in infection chains that ultimately lead to NetSupport RAT deployment; specifically, Recorded Future reported that the fake browser update infection vector uses MaskBat to execute NetSupport RAT. GrayAlpha’s broader delivery ecosystem was observed using fake browser update pages, fake 7-Zip download sites, and the TAG-124 traffic distribution system, with all three vectors resulting in NetSupport RAT infections, although PowerNet rather than MaskBat was reported for the latter two paths. Since at least April 2024, GrayAlpha’s fake browser update lures have impersonated products and services including Google Meet, LexisNexis, Asana, AIMP, SAP Concur, CNN, the Wall Street Journal, and Advanced IP Scanner. High-confidence attribution in the provided content links MaskBat to GrayAlpha/FIN7-associated operations and to malware delivery rather than standalone post-compromise functionality. No specific file hashes, domains, or IP indicators were provided for MaskBat itself in the supplied content.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Insikt Group identified another custom loader, referred to as MaskBat, that has similarities to FakeBat but is obfuscated and contains strings linked to GrayAlpha.
Insikt Group identified another custom loader, referred to as MaskBat, that has similarities to FakeBat but is obfuscated and contains strings linked to GrayAlpha.
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Insikt Group identified three main infection vectors associated with GrayAlpha: fake browser update pages, fake 7-Zip download sites, and the TDS TAG-124 network.
Overall, Insikt Group found three primary infection methods: fake browser update pages, fake 7-Zip download sites, and the traffic distribution system (TDS) TAG-124.
Insikt Group identified another custom loader, referred to as MaskBat, which has similarities to FakeBat but is obfuscated and contains strings linked to GrayAlpha.
These sites impersonate a range of legitimate products and services, including Google Meet, LexisNexis, Asana, AIMP, SAP Concur, CNN, the Wall Street Journal, and Advanced IP Scanner, among others.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.