Malware

DeviceManager

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

T1059Command and Scripting InterpreterEvidence1

DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe."

T1059.001PowerShellEvidence1

ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component.

T1059.003Windows Command ShellEvidence1

DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe."

T1059.006PythonEvidence1

DeviceManager is equipped to run PowerShell and Python scripts

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

Privilege Escalation

1 technique

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

Stealth

1 technique

T1070Indicator RemovalEvidence1

clean up persistence mechanisms likely to erase forensic evidence... If a target CIS language is detected, DeviceManager executes a self-deletion routine: it removes its scheduled task, deletes its installation directory via cmd.exe, and terminates process execution.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it... The malware then proceeds to collect extensive device information

T1614.001System Language DiscoveryEvidence1

At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

communicate with the server over HTTP or DNS tunneling

T1071.004DNSEvidence1

DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling.

T1102.001Dead Drop ResolverEvidence1

The second payload delivered via the DOUBLECUP infrastructure is a modular Python-based RAT codenamed DeviceManager that utilizes the blockchain as a dead drop resolver to fetch the C2 server details, a technique known as EtherHiding.

T1105Ingress Tool TransferEvidence1

allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files, download a compressed archive, extract its contents, and run the main binary present within the extracted folder

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it... communicate with it using DNS or HTTP to exfiltrate system data

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 4, 2026

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

Previously undocumented modular Python-based RAT distributed via a Delphi-compiled Inno Setup installer. It resolves active C2 nodes through Ethereum/Polygon smart contracts using EtherHiding, avoids CIS-language systems, collects device information, exfiltrates data, polls for tasks, downloads payloads, and executes PowerShell, Python, and cmd.exe commands.

bleeping computerNews

Aug 3, 2026

New DOUBLECUP ClickFix service hides malware in browser cache images

Previously undocumented modular Python-based Windows RAT delivered by DOUBLECUP. It gathers host and domain information outside CIS countries, uses EtherHiding via Ethereum or Polygon smart contracts to resolve C2 infrastructure, and uses DNS A and TXT records for command retrieval, payload download, exfiltration, and command output return.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

DeviceManager

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Campaigns using DOUBLECUP have leveraged a cluster of bogus sites impersonating CRM login pages, including NetSuite, Odoo, HubSpot, and Salesforce, to deliver the loader via embedded iframe elements.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

T1059Command and Scripting InterpreterEvidence1

DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe."

T1059.001PowerShellEvidence1

ClickFix commands that, upon execution, search the browser cache for the PNG image and extract from it malicious JavaScript, VBScript, or PowerShell to launch the next-stage component.

T1059.003Windows Command ShellEvidence1

DeviceManager is equipped to run PowerShell and Python scripts, as well as pipe operator-issued commands into "cmd.exe."

T1059.006PythonEvidence1

DeviceManager is equipped to run PowerShell and Python scripts

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

Privilege Escalation

1 technique

T1053Scheduled Task/JobEvidence1

One of the malware families propagated via this method is an updated Windows and macOS version of CountLoader, which comes with new capabilities to establish persistence using scheduled tasks

Stealth

1 technique

T1070Indicator RemovalEvidence1

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it... The malware then proceeds to collect extensive device information

T1614.001System Language DiscoveryEvidence1

At the same time, it deliberately avoids executing on machines that resolve to Commonwealth of Independent States (CIS) language locales.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

communicate with the server over HTTP or DNS tunneling

T1071.004DNSEvidence1

DeviceManager, which utilizes EtherHiding to resolve its command-and-control (C2) infrastructure and communicate with the server over HTTP or DNS tunneling.

T1102.001Dead Drop ResolverEvidence1

T1105Ingress Tool TransferEvidence1

allowing it to run secondary executables, DLLs, MSI, or HTML Application (HTA) files, download a compressed archive, extract its contents, and run the main binary present within the extracted folder

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The primary objective of CountLoader is to connect to a C2 server, gather system metadata and exfiltrate it... communicate with it using DNS or HTTP to exfiltrate system data

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Aug 4, 2026

DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT

bleeping computerNews

Aug 3, 2026

New DOUBLECUP ClickFix service hides malware in browser cache images

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.