Threats Tagged 'hidden desktop'

This threat describes a multi-stage malware intrusion initiated by a ClickFix social engineering attack on an unmonitored endpoint. The attack chain begins with a malicious HTA payload that installs Potemkin, a custom loader using a deterministic domain generation algorithm (DGA). Potemkin delivers RMMProject, a Lua-scriptable remote access trojan (RAT) capable of browser credential theft, hidden desktop control, and multiple task types. The attacker also deploys EtherRAT, a Node.js backdoor using Ethereum blockchain for command and control (C2) resolution, and establishes a Cloudflare tunnel for persistence. The attacker actively disables Windows Defender and uses lateral movement techniques such as WMIExec and SMBExec to spread malware and reach the domain controller.