Netsupport

NetSupport is a legitimate remote access software that has been exploited as a malware tool by various threat actors. It's often used in combination with other malicious software like BlackBasta Ransomware, IcedID, and occasionally Lumma Stealer, the most common infostealer in the world today. The malware can infect systems through suspicious downloads, emails, or websites, often without user awareness. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. Notably, NetSupport was used during a Royal ransomware attack and has been employed by former ITG23 members and affiliates in their cyberattacks. The infection process of NetSupport RAT (Remote Access Trojan) is multi-staged and begins with the downloading of a JavaScript file from a malicious website. This initial file retrieves, downloads, and runs NetSupport RAT through several stages of other JavaScript payloads. Ultimately, a ZIP archive containing all necessary files to run NetSupport RAT is downloaded, extracted, and run on the victim's computer. Once operational, NetSupport RAT beacons out to a command and control (C2) server, notifying threat actors that the PC is ready for unauthorized access. Detection and monitoring of such attacks are possible through tools like InsightIDR Attacker Behavior Analytics. These tools can identify suspicious processes and modifications of files, indicative of an attacker's activity. For instance, in one observed case, the attacker used the 7zip compression utility and the NetSupport Manager remote access tool. It's crucial to remember that while NetSupport RAT is used for malicious purposes in these instances, NetSupport itself is a legitimate remote software company. The malware emails analyzed in these scenarios are often basic yet manage to bypass email security systems.