# SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT via Two-Stage Loader (Unidentified Initial RAT, Encoded TCP/443 C2)

> The SmartApeSG ClickFix campaign used a fake browser-verification page to trick a Windows user into copy-pasting and running a malicious command, installing an unidentified initial RAT that beacons with encoded (non-TLS) traffic over TCP 443. That RAT pulled a second-stage package whose VBS/batch loader chain (processor.vbs -> token.bat -> setup.cab) extracted and persisted a malicious NetSupport Manager RAT under C:\ProgramData\UpdateInstaller\, then self-deleted its droppers.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0647
- **ID:** TL-2026-0647
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SmartApeSG
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-05-27, SANS Internet Storm Center handler Brad Duncan documented a fresh wave of the SmartApeSG (a.k.a. ZPHP) ClickFix campaign culminating in a malicious NetSupport Manager RAT. The infection begins with SmartApeSG's injected JavaScript serving a fake browser verification / CAPTCHA page (ClickFix). The page socially engineers the victim into copying an attacker-supplied command to the clipboard and executing it via the Windows Run dialog (MITRE T1204.004, Malicious Copy and Paste) -- the hallmark ClickFix pattern observed across SmartApeSG waves, which typically resolves to an mshta- or PowerShell-staged download.

Stage 1 - Unidentified initial RAT: Execution of the ClickFix command retrieves a large (~26.5 MB) ZIP software package (SHA256 1514b126...be976) from hxxps://silverharvestnetwork[.]com/check, with intermediate script traffic to 178.156.165[.]82 and 178.156.173[.]194. The installed initial RAT establishes an outbound channel to 89.110.110[.]119 on TCP 443 using encoded -- not HTTPS/SSL/TLS -- traffic. Riding cleartext-but-encoded data on port 443 lets the beacon blend with HTTPS egress while evading TLS inspection (T1571 Non-Standard Port behavior layered with T1132 Data Encoding). ISC reports this C2 host has been active since approximately April 2026. The specific RAT family is unidentified at time of reporting.

Stage 2 - NetSupport loader chain: The initial RAT drops a second-stage payload to C:\ProgramData\. processor.vbs (109 bytes, SHA256 469bac8e...201e5) is a minimal launcher whose sole job is to run token.bat. token.bat (8,262 bytes, SHA256 9c7eda2c...ba33f5; a DOS batch file with very long obfuscated lines) extracts setup.cab (~17.3 MB Microsoft Cabinet archive, SHA256 7ba5481c...c2112) into C:\ProgramData\UpdateInstaller\, launches the embedded NetSupport Manager RAT client, and installs persistence. Consistent with standard malicious NetSupport tradecraft, the CAB payload comprises the legitimate NetSupport client (client32.exe) plus its supporting DLLs and a weaponized client32.ini pointing the gateway at the attacker's server; persistence is typically via an HKCU ...\CurrentVersion\Run value. After NetSupport is running and persistent, token.bat deletes processor.vbs, token.bat, and setup.cab (T1070.004 Indicator Removal: File Deletion), leaving only the UpdateInstaller folder on disk.

Stage 2 C2 - NetSupport Manager: The deployed NetSupport client communicates with hxxp://185.163.47[.]217 on TCP 443. NetSupport Manager is a legitimate commercial remote-administration tool (T1219 Remote Access Tools) abused here for hands-on-keyboard remote control, file transfer, and follow-on tooling.

This wave uses entirely new infrastructure and hashes (89.110.110.119, 185.163.47.217, 178.156.165.82, 178.156.173.194, hiddenplanetlab[.]top, silverharvestnetwork[.]com, four file hashes) distinct from prior SmartApeSG Remcos waves (cf. TL-2026-0225). ISC notes the domains and file hashes rotate on a daily basis, so behavioral and host-artifact detection (ProgramData VBS/BAT/CAB staging, UpdateInstaller folder, encoded TCP/443 beacon, Run-key persistence to a ProgramData NetSupport client) is more durable than static IOCs.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1218 System Binary Proxy Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1571 Non-Standard Port
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer

## Sources

- [ISC Diary 33034 - Unidentified RAT pushes NetSupport RAT (Brad Duncan)](https://isc.sans.edu/diary/Unidentified+RAT+pushes+NetSupport+RAT/33034/)
- [Brad Duncan - malware-traffic-analysis.net (SmartApeSG traffic analysis)](https://www.malware-traffic-analysis.net/)
- [MITRE ATT&CK T1204.004 - User Execution: Malicious Copy and Paste (ClickFix)](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1219 - Remote Access Tools (NetSupport Manager abuse)](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK T1218.005 - System Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
- [MITRE ATT&CK T1070.004 - Indicator Removal: File Deletion](https://attack.mitre.org/techniques/T1070/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0647