Netsupport

NetSupport is a legitimate remote access software that has been repurposed as malware by various cybercriminal groups. It has been observed in several high-profile cyber-attacks, including the Royal ransomware attack and operations conducted by former ITG23 members. The malware can infiltrate systems through deceptive downloads, emails, or websites, often unbeknownst to the user. Once installed, it can steal personal data, disrupt system operations, or even hold data for ransom. Other notable malware such as BlackBasta Ransomware, IcedID, CobaltStrike, Ligolo-NG, and CryptOne have also been used alongside NetSupport. The NetSupport Remote Access Trojan (RAT) functions by connecting to a Command and Control (C2) server, notifying threat actors that the infected PC is ready for unauthorized access. This access could be utilized directly by the attackers or sold on the dark web. A typical NetSupport RAT C2 connection is initialized using multiple keys and values contained in a "Client.ini" configuration file. Additionally, the malware employs techniques like appending "/fakeurl.htm" to the IP address to solidify its C2 connection. In recent attacks, the final payload delivered to victims was a ZIP archive containing all necessary files to run NetSupport RAT. This was achieved through a series of JavaScript files that ultimately download, extract, and execute the RAT. Despite their simplicity, these malicious emails carrying NetSupport RAT have managed to bypass email security measures. Notably, the malware has been deployed alongside Lumma Stealer, the world's most common infostealer, and Redline, a credential-stealing malware, by the cybercriminal group Fin7.