NetSupport RAT via link-free mail

Summary

From 5 September 2024, Proofpoint saw mail signed "Security Agent" telling recipients that unnamed software on their machine had to be patched, with step-by-step wording for opening a terminal and typing an encoded command themselves. Nothing was attached and there was no link at all, which is why the message read as ordinary correspondence and had little for a mail gateway to catch. Running the command fetched a further script, which in turn pulled down 7-Zip together with a password-protected archive, unpacked it and started NetSupport, a legitimate remote-control product repurposed as a backdoor. Proofpoint notes that variants asking this much of the recipient are probably less productive than the ones that fill the clipboard for them. The sender address at a free German mail provider is the only indicator published for it.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is PowerShell (T1059.001), which 19 of the 44 published campaigns in this corpus also record (43%).

Indicators

1 indicator, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.