Loading malware…
LiteManager is a legitimate remote monitoring and management tool that has been abused by threat actors as an intrusion-enabling payload. In observed malicious use, it has been delivered through phishing campaigns and installed via MSI packages to provide remote access to compromised systems. Because it is legitimate administration software, its use can blend with normal remote-support activity and may reduce suspicion while giving operators persistent interactive access.
Russia-aligned intrusion activity attributed to UAC-0050, also associated with the DaVinci Group and the Fire Cells branding, has used LiteManager in campaigns primarily targeting Ukrainian organizations. Reported targeting has included governmental, defense-related, energy, gas, media, manufacturing, and financial-sector entities, as well as other organizations connected to Ukraine. In these operations, LiteManager formed part of broader campaigns involving social engineering, impersonation themes, and follow-on objectives including intelligence collection, financial theft, and psychological operations.
Within UAC-0050 tradecraft, LiteManager appears alongside other remote access and malware tooling such as Remcos, NetSupport Manager, sLoad, and Remote Manipulator System, reflecting a pattern of abusing legitimate remote administration software for covert access. High-confidence reporting supports its use as a remote-access payload delivered through phishing rather than as a self-propagating or destructive malware family.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On December 25th, the same Russian IP ‘109.71.247[.]168’ ... Once unpacked it revealed an executable used to deploy the LiteManager MSI.
"...the threat actor known to drop legitimate remote access software like LiteManager..."
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Attached to the mail could be found a RAR archive, itself containing a ZIP archive unveiling a shortcut file (LNK).
Attached to the mail was a PDF document faking Google Drive and displaying a hypertext link pointing to a Bitbucket folder, which contained a ZIP archive.
Attached to the mail was a ZIP archive containing a PDF with the same kind of template found in the December 2024 campaign, with a hypertext link leading to a JS file hosted by 4sync.
Once unzipped, it unveiled a text file providing a password ‘3902879’, used to decrypt a RAR archive contained with it... Inside this RAR archive could be found a 32-bit executable Remcos payload.
Once launched, they would both download a SmokeLoader payload from the following URL, posing as a legitimate PuTTY executable.
Для последующего закрепления в системе и продвижения внутри локальной сети организации злоумышленники использовали легитимные программы для удаленного доступа, такие как LiteManager и RMS...
The VBS script’s purpose was to download an obfuscated and weaponized version of the SSH client PuTTY through the following Bitbucket folder.
Когда токен подключен к компьютеру, злоумышленники переходят к следующему этапу атаки и разворачивают в системе инструменты удаленного доступа. В частности, исследователи наблюдали использование LiteManager...
Inside this RAR archive could be found a 32-bit executable Remcos payload that would communicate with its C2 on IP ‘111.90.140[.]65:2404’.
85 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.