Detecting evolving threats: Net Support RAT campaign
Summary: Cisco Talos analyzed a NetSupport RAT campaign, first identified in November 2023, that uses fake browser updates on compromised and malicious websites to deliver a stager which runs PowerShell commands and installs the NetSupport Manager agent with user-level registry persistence. A January 2024 analysis of the same campaign showed changes to the initial JavaScript payload and randomized installation paths, and Talos reported hundreds of known stager variants across dozens of domains in a large-scale malicious advertising campaign.
What you should know: NetSupport Manager has been a commercial remote administration tool since 1989 and has been used maliciously since 2017, so the tool itself is legitimate and the campaign's pre-computed, reused obfuscation is what gives defenders a static handle on hundreds of stager variants.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026