MalwarePublished 10 Jul 2025Updated 9 Aug 2025

Deploying NetSupport RAT via WordPress & ClickFix

Source AlienVault OTX General

Description

A threat actor is using compromised WordPress websites to distribute a malicious version of NetSupport Manager Remote Access Tool (RAT). The attack chain involves phishing campaigns, website compromise, DOM manipulation, and a fake CAPTCHA page. The malware is delivered through a batch file that downloads and executes NetSupport Client files. Post-infection, the attacker uses NetSupport's features for reconnaissance and further exploitation. The attack utilizes various JavaScript files and DOM manipulation techniques to evade detection. Multiple IP addresses and domains associated with the attack infrastructure have been identified, primarily linked to hosting providers in Moldova.

Impact

For European organizations, this threat poses significant risks primarily due to the widespread use of WordPress for websites and the legitimate nature of NetSupport Manager, which may bypass some security controls. Successful compromise can lead to unauthorized remote access, data exfiltration, espionage, and lateral movement within corporate networks. The use of phishing and fake CAPTCHA pages increases the likelihood of user compromise, especially in organizations with less mature security awareness programs. The attack can disrupt business operations, compromise sensitive data, and damage organizational reputation. Given the multi-stage nature of the attack and the use of legitimate remote access tools, detection and response can be challenging, potentially allowing attackers prolonged access. European organizations in sectors with high-value data or critical infrastructure may face increased risk of targeted exploitation or espionage. Additionally, the presence of hosting infrastructure in Moldova may complicate attribution and takedown efforts, prolonging the threat's persistence in the region.

Defensive guidance

1. Harden WordPress installations by regularly applying security patches, removing unused plugins/themes, and enforcing strong authentication mechanisms such as multi-factor authentication (MFA) for administrative access. 2. Implement robust phishing awareness training tailored to recognize fake CAPTCHA pages and suspicious download prompts. 3. Employ advanced web application firewalls (WAFs) capable of detecting DOM manipulation and anomalous JavaScript behavior on websites. 4. Monitor network traffic for connections to known malicious IP addresses and domains associated with this campaign, leveraging threat intelligence feeds to update blocklists. 5. Restrict or monitor the use of remote administration tools like NetSupport Manager, ensuring they are only installed and used by authorized personnel with strict access controls and logging enabled. 6. Deploy endpoint detection and response (EDR) solutions capable of identifying batch file executions and unusual process behaviors related to NetSupport Client components. 7. Conduct regular audits of website integrity and implement file integrity monitoring to detect unauthorized changes indicative of compromise. 8. Segment networks to limit lateral movement opportunities post-compromise and enforce the principle of least privilege. 9. Establish incident response procedures specifically addressing RAT infections and remote access tool abuse. 10. Collaborate with hosting providers and law enforcement to report and mitigate malicious infrastructure, particularly those located in Moldova.

Indicators of compromise

Domains 8

ace-project.org
badgervolleyball.org
christianlouboutin2017.top
fmovies123.top
jaagnet.com
jakestrack.com
lang3666.top
pemptousia.com

IP addresses 10

193.111.208.110
79.141.173.158
94.158.245.131
107.180.0.222
50.87.146.66
77.83.199.34
83.229.17.68
94.158.245.104
94.158.245.118
94.158.245.137

Hashes 12

1768c9971cea4cc10c7dd45a5f8f022a
20ed4df3a9c734c1788bd2ca2658aedb
4f496bfde39ca83644265d8d1d9bc9da
9c4349534c137e3e43fb2e2caf049f9d
c05f8ec5afbabc36f1c1366549290ae6
ee75b57b9300aab96530503bfae8a2f2
3d199bee412cbac0a6d2c4c9fd5509ad12a667e7
98dd757e1c1fa8b5605bda892aa0b82ebefa1f07
ec54e200a791480fa3341ff5db4beb3662b885f1
06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Jul 2025, 22:16 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

Domains 8

IP addresses 10

Hashes 12

Community reviews

Related threats