Netsupport Rat

NetSupport RAT is a malicious software (malware) that poses a significant threat to organizational safety. The malware, which can be spread through suspicious downloads, emails, or websites, infiltrates systems without detection and has the potential to steal personal information, disrupt operations, or hold data hostage for ransom. NetSupport RAT is particularly dangerous because once it enters a company's system, it signals to threat actors that the PC is ready for unauthorized access, either by the threat actors themselves or to be sold on the dark web. It is important to note that while NetSupport RAT is used maliciously in this context, NetSupport is a legitimate remote software company. The malware operates via a configuration file known as "Client.ini", which contains multiple keys and values that initialize the connection to its command and control (C2). Some embedded modules contain the client32.exe file from the NetSupport RAT. When the malware runs on a victim computer, it reaches out to a C2 to notify threat actors. In addition, the Wireshark output reveals that “/fakeurl.htm” has been appended to the IP address, further identifying this IP address as our C2 for this particular NetSupport RAT sample. The cybercriminal group FIN7 has been promoting an existing malvertising campaign that targets corporate users with content from popular brands to disseminate the NetSupport RAT. This is done through various methods including luring victims to download a JavaScript file that retrieves, downloads, and runs NetSupport RAT through several stages of other JavaScript payloads. Furthermore, Silent Push disclosed a second campaign run by FIN7, designed to covertly distribute NetSupport RAT malware through lookalike sites requiring visitors to install a browser extension. Despite their simplicity, the NetSupport RAT emails analyzed have managed to bypass email security, underlining the sophistication of these attacks.