Threat reportMalwareTL-2026-1487
Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)
Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (TL-2026-1487), also tracked as NetSupport RAT Loader, is a medium-severity malware campaign, first published 2026-07-18. It is attributed to SmartApeSG with medium confidence, affects Microsoft Windows (all supported desktop versions), maps to 28 MITRE ATT&CK techniques (T1016, T1027, T1033), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 28MITRE ATT&CK
- Actors
- 1SmartApeSG
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1487
- Threat ID
- TL-2026-1487
- Also known as
- NetSupport RAT Loader, NetSupportManager RAT
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- SmartApeSG
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- all sectors opportunistic drive-by mass-market lures, finance, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Multi-Stage NetSupport RAT Loader Using Layered Obfuscation
Malware and tooling: NetSupportManager RAT, NetSupport Manager, NetSupport RAT client32 protocol (TCP/443, TCP/447, TCP/2552)
How Multi-Stage NetSupport RAT Loader Using Layered Obfuscation works
A three-stage NetSupport RAT loader (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab) uses decimal-array subtraction decoding, AES-ECB-encrypted/base64/GZIP-packed PowerShell, and a second decimal-array stage to progressively unpack and launch a portable NetSupport Manager RAT installation on the victim host. The loader chain matches the broader 2024-2025 NetSupport RAT resurgence tracked by Talos, Red Canary, and Team Cymru, in which SmartApeSG/FakeUpdates-style fake-browser-update and ClickFix lures drop the same client32.exe payload against rotating C2 infrastructure.
This threat documents a multi-stage NetSupport RAT (NetSupportManager RAT) loader analyzed via a 22-operation CyberChef recipe by embee-research (2024-02-26) against a sample retrieved from Malware Bazaar (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab).
The loader executes in three obfuscation stages. Stage 1 embeds the next-stage PowerShell script as a large decimal integer array; each element has a fixed value (787) subtracted from it before being converted from decimal to an ASCII character code, reassembling a Stage 2 PowerShell script. Stage 2 contains an AES key (a 44-character base64 string embedded in single quotes) and a base64-encoded ciphertext blob. After base64-decoding the blob, the first 16 bytes are extracted and used as the AES initialization vector; the remainder is decrypted with AES in ECB mode, trailing null bytes are stripped, and the result is GZIP-decompressed to reveal Stage 3. Stage 3 repeats the decimal-array/subtraction technique from Stage 1 but with a different subtraction constant (4274) applied across four separate arrays, ultimately reconstructing PowerShell logic that invokes Net.Webclient to retrieve further payloads and resolve command-and-control URLs.
The end state of this loader family, consistent across the broader 2023-2025 NetSupport RAT campaign tracked independently by Cisco Talos, VMware, Red Canary, Team Cymru, ThreatDown, and OpenText, is deployment of a portable, unlicensed copy of the legitimate NetSupport Manager remote-administration tool (client32.exe) with attacker-controlled configuration pointed at rotating C2 infrastructure. NetSupport Manager is a 30-year-old commercial remote-support product that is trivially repurposed as a full-featured RAT: operators can lock the victim's mouse/keyboard, execute arbitrary commands including shutdown/reboot, and capture screen, audio, and video for surveillance. Persistence is established at user level via an HKCU Run-key registry entry and/or a .url shortcut in the Startup folder, with some variants additionally using scheduled tasks. Delivery vectors documented across the wider campaign include malicious/compromised-site JavaScript stagers (SmartApeSG/FakeUpdates fake browser-update lures), ClickFix-style fake CAPTCHA pages that trick users into pasting and running a PowerShell one-liner (T1204.004, the most prevalent 2025 delivery vector per Red Canary), and secondary-payload delivery from SocGholish, Qbot, and Scarlet Goldfinch infections. C2 infrastructure observed in the related SmartApeSG-to-NetSupport RAT infection chain is hosted primarily on Moldovan MivoCloud IP space with NetSupport RAT client traffic on TCP/443, TCP/447 and TCP/2552, and separate RDP/WinRM-exposed management hosts identified by X.509 certificate common names (e.g., CN=MATRACHEDICIDGA matching management host 5.181.157.69). A large, rapidly rotated pool of C2 domains (dozens of randomly-generated .cn/.icu/.xyz/.top/.com/.net names) is used to hinder tracking and takedown, alongside legitimate-service abuse (fex.net cloud storage, an exploit.im Jabber server) and brand-impersonation sites for trading/financial lures.
MITRE ATT&CK techniques used in TL-2026-1487
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Collection
T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
Execution
T1059 Command and Scripting Interpreter; T1072 Software Deployment Tools; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573 Encrypted Channel
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Impact
Affected products and versions in Multi-Stage NetSupport RAT Loader Using Layered Obfuscation
- Microsoft — Windows (all supported desktop versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server - NetSupport Ltd — NetSupport Manager
Vulnerable versions: Free trial / any licensed version, abused as unlicensed portable install
Remediation for Multi-Stage NetSupport RAT Loader Using Layered Obfuscation
Immediate actions
- Block the identified C2 IPs (5.181.159.111, 5.181.159.113, 5.181.159.119, 45.8.145.132, 45.67.35.101, 185.153.183.59, 95.164.37.152, 194.31.109.74, 194.180.191.229, 194.180.191.121) and domains at perimeter firewall/DNS.
- Hunt for client32.exe running outside Program Files (ProgramData, Downloads, or user Roaming folders) via EDR.
- Search HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the user Startup folder for unauthorized NetSupport-related entries or .url shortcuts.
- Deploy the Cisco Talos Snort coverage (SID 44678, SIDs 53539-53544) or equivalent IDS signatures for NetSupport RAT C2 traffic.
Workarounds
- Restrict outbound access on non-standard high ports (TCP/447, TCP/2552) to reduce viable NetSupport RAT C2 channels.
- Enforce PowerShell Constrained Language Mode / AMSI logging to increase visibility into multi-stage obfuscated loader scripts.
Longer-term hardening
- Block or alert on unlicensed/portable NetSupport Manager installers at the EDR/application-control layer; NetSupport Manager's free trial is trivially obtainable and widely abused.
- Deploy application allowlisting to prevent unsigned/portable remote-access tools from executing.
- Train users to recognize fake browser-update and ClickFix/fake-CAPTCHA copy-paste lures; disable or restrict the Windows Run dialog for high-risk user groups.
- Monitor for anomalous AES/base64/GZIP-obfuscated PowerShell in EDR script-block logging.
Timeline of Multi-Stage NetSupport RAT Loader Using Layered Obfuscation
- Cisco Talos releases initial Snort coverage (SID 44678) for NetSupport RAT command-and-control network traffic, marking early industry tracking of the tool's malicious abuse.
- Cisco Talos expands NetSupport RAT network detection coverage with Snort SIDs 53539-53544 as the malware's C2 protocol usage evolves.
- VMware Security Blog publishes 'NetSupport RAT: The RAT King Returns,' documenting a significant resurgence of NetSupport RAT campaigns.
- Team Cymru and ThreatDown/Malwarebytes independently track the SmartApeSG (ZPHP/HANEYMANEY/FakeSG) threat cluster distributing NetSupport RAT and StealC via fake browser-update and FakeUpdates-style lures on compromised websites, identifying Moldovan MivoCloud-hosted management infrastructure and a rotating pool of dozens of C2 domains.
- embee-research publishes a 22-step CyberChef walkthrough deobfuscating this specific three-stage NetSupport loader sample (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab), detailing the decimal-array/subtraction, AES-ECB+base64+GZIP, and second decimal-array decoding stages.
- ThreatDown/Malwarebytes documents the SmartApeSG/FakeSG cluster co-delivering StealC infostealer alongside NetSupport RAT from the same fake-browser-update infection chain, expanding the campaign's objectives beyond remote access to credential/cookie theft.
- Cisco Talos publishes 'Detecting evolving threats: NetSupport RAT campaign,' mapping the multi-stage JavaScript/PowerShell delivery chain to MITRE ATT&CK and releasing associated IOCs and Snort coverage.
- Red Canary's Threat Detection Report ranks NetSupport Manager the 4th most prevalent threat observed in customer environments for 2025 (up from 7th in 2024), with Malicious Copy and Paste (T1204.004) / ClickFix-style lures identified as the primary delivery vector.
- Red Canary and other vendors report a marked 2025 shift in SmartApeSG/NetSupport RAT delivery away from fake-browser-update JavaScript stagers toward ClickFix-style fake CAPTCHA pages that socially engineer victims into manually pasting and executing the PowerShell loader via the Windows Run dialog.
Sources cited for Multi-Stage NetSupport RAT Loader Using Layered Obfuscation
- Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
- Detecting evolving threats: NetSupport RAT campaign
- NetSupport Manager | Red Canary Threat Detection Report
- Tracing the Path from SmartApeSG to NetSupport RAT
- FakeSG enters the 'FakeUpdates' arena to deliver NetSupport RAT
- NetSupport Remote Access Trojan (RAT) delivered through fake browser updates by SocGholish threat actors
- NetSupport RAT: The RAT King Returns
- NetSupportManager RAT (Malware Family)
- Gotta Catch 'Em All | Understanding the NetSupport RAT Campaigns Hiding Behind Pokemon Lures
- NetSupport RAT: Why Legitimate Tools Are as Damaging as Malware
- How NetSupport RAT Abuses Legitimate Remote Admin Tool
Detection coverage for TL-2026-1487
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1487 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.