Netsupport Manager

NetSupport Manager is a malicious software (malware) that poses significant threats to computer systems and networks. It is often disguised as legitimate software or tools, such as the 7-zip compression utility or a fake Chrome browser update, to trick users into downloading and installing it. Once installed, NetSupport Manager can grant cybercriminals control over victim computers and access to their data. One of its key characteristics is its ability to spawn suspicious processes, such as those detected by InsightIDR Attacker Behavior Analytics. These include processes spawned by Outlook Web Access and modification of files in Exchange Webroot. The malware was observed in various cyber-attack campaigns. In June 2020, IcedID and NetSupport Manager RAT-based malware were delivered on a Windows 7 host. In another instance, Trellix exposed a scheme where the malware was snuck onto victims' computers via fake Chrome browser updates. Kroll's investigation suggested that Royal ransomware actors likely gained access to a network by purchasing it from an unrelated actor, installing a renamed version of NetSupport Manager in the process. The malware also featured prominently in the Storm-1811 campaign led by Microsoft, where it was used alongside other malware like Qakbot and Cobalt Strike to compromise devices. NetSupport Manager's potency lies in its ability to maintain control over compromised devices, allowing cybercriminals to download and install additional malware and launch arbitrary commands. The malware uses a configuration file ("client32.ini") that reveals the IP address of the NetSupport Manager (the C2). This capability was utilized in the PhantomBlu campaign, where attackers impersonated an accounting service to deliver the notorious NetSupport RAT. Upon extraction via the downloaded 7-zip utility, execution occurs via a scheduled task, orchestrated by the "2.bat" batch file. This file also ensures persistence for the RAT, triggering automatic execution upon system startup.