Netsupport Manager

NetSupport Manager is a malicious software (malware) that infiltrates systems through suspicious downloads, emails, or websites. Once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. The malware has been detected by InsightIDR Attacker Behavior Analytics due to its suspicious process and modification of files. The attacker uses the 7zip compression utility and the NetSupport Manager remote access tool to carry out their activities. In one instance in June 2020, both IcedID and NetSupport Manager RAT-based malware were delivered as follow-up malware on a Windows 7 host. The malware has been used in various schemes, such as fake Chrome browser updates, to sneak onto victim computers, granting cybercriminals control and data access. It was also found in an incident where Royal ransomware actors likely gained access into an environment by purchasing their way in from an unrelated actor. Once access is granted, hackers download malicious payloads, some of them masquerading as spam filter files, enabling them to install the Qakbot malware, remote management tools like ScreenConnect and NetSupport Manager, and Cobalt Strike. These actions often culminate in the deployment of Black Basta ransomware. In addition to these incidents, the NetSupport Manager has been deployed to maintain control over compromised devices, allowing further download and installation of additional malware, and launching arbitrary commands. Microsoft observed this during the Storm-1811 campaign, which delivered a flurry of malware to victim machines, including NetSupport Manager. In another campaign dubbed "PhantomBlu," attackers impersonated an accounting service in email messages inviting people to download a Microsoft Office Word file, which ultimately delivered the notorious NetSupport RAT. The malware is extracted via the downloaded 7-zip utility, executed via a scheduled task, and ensures automatic execution upon system startup.