Malware19 associated actors

NetSupport RMM

Tracked since Mar 17, 2026 · Updated 8 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors19Associated

ATT&CK1Technique

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Threat actors

Associated threat actors

19 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details →

LazyScripter

The following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool... This helps to identify instances where the legitimate NetSupport tool is being misused by adversaries as a Remote Access Trojan (RAT).

via splunk researchresearch.splunk.com

TeamTNT

via splunk researchresearch.splunk.com

BRONZE BUTLER

via splunk researchresearch.splunk.com

ZIRCONIUM

via splunk researchresearch.splunk.com

Storm-1811

via splunk researchresearch.splunk.com

Aoqin Dragon

via splunk researchresearch.splunk.com

+13 more in the app. View in Mallory

MITRE ATT&CK

Techniques & procedures

1 distinct technique documented for this family, organized by ATT&CK tactic.

Stealth

1 technique

T1036MasqueradingEvidence2

Windows NetSupport RMM DLL Loaded By Uncommon Process ... Masquerading

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

splunk researchNews · Nov 20, 2025Detection: Windows NetSupport RMM DLL Loaded By Uncommon Process | Splunk Security ContentA legitimate remote management tool that adversaries abuse as a remote access trojan for persistence and remote control on Windows systems, detectable via characteristic NetSupport DLL loads from unusual paths or renamed executables.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actors19Groups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping1Every documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

NetSupport RMM

Tracked since Mar 17, 2026 · Updated 8 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

Vulns0Associated

Actors19Associated

ATT&CK1Technique

IOCs0Tracked

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure