Skip to navigation

Threat reportThreat IntelligenceTL-2026-2387

ClearFake WebDAV infection chain delivering Amatera stealer 4.1.5-alpha, ZigCryptoStealer, and NetSupport Manager 12.44 (UAT-10820)

criticalACTIVE

Cisco Talos documented a multi-stage ClearFake infection chain first detected via suspicious WebDAV DLL execution ("verification.google" launched by 32-bit rundll32.exe) at a Ukrainian government organization. Compromised websites serve a Cloudflare Worker that pulls malicious JavaScript from BNB Smart Chain testnet contracts (EtherHiding), then uses a ClickFix fake-Google-CAPTCHA prompt to drive WebDAV-based DLL loading.

Key facts

IdentifiersTL-2026-2387
Also known asEtherHiding WebDAV ClickFix chain, ACR/Amatera WebDAV campaign, Jquery.min.js NativeAOT loader
SeverityCRITICAL
First disclosed
Affected productsMicrosoft Windows; NetSupport NetSupport Manager (client32.exe 12.44); MOCOMSYS & DCRC NEOVM / DCRCV_U kernel driver (DCRCVDrv.sys); Google Chrome (platform_experience_helper.exe)
AttributionUAT-10820 (medium confidence)
Nation-state nexusRussia
MalwareACR Stealer, Amatera (ACR) Stealer, ClearFake, Netsupport Manager, ZigCryptoStealer
ToolsHashiCorp Yamux, NetSupport Manager
MITRE ATT&CK techniquesT1005 Data from Local System, T1027.002 Obfuscated Files or Information: Software Packing, T1036.005 Match Legitimate Resource Name or Location, T1053.005 Scheduled Task/Job: Scheduled Task, T1055.001 Dynamic-link Library Injection, T1059.001 Command and Scripting Interpreter: PowerShell, T1071.001 Application Layer Protocol: Web Protocols, T1102.001 Web Service: Dead Drop Resolver, T1204.001 User Execution: Malicious Link, T1218.011 System Binary Proxy Execution: Rundll32, T1497.001 Virtualization/Sandbox Evasion: System Checks, T1555.005 Credentials from Password Stores: Password Managers and 4 more in the attack flow
MotivationFINANCIAL
Target sectorsgovernment administration, finance, technology
Target regionsGlobal, ukraine, Europe, North America
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-09-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2387 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WebDAV Rundll32 Execution of Extension-Less DLL via ClickFix Social Engineering

Detects the core execution primitive of the ClearFake chain: 32-bit rundll32.exe executing an extension-less or WebDAV-hosted DLL (pf.ch, verification.google) by ordinal #1. The command is reconstructed via delayed-expansion environment variable manipulation in cmd.exe and launched from a WebDAV (\leaguejazire.com...) UNC path. This is the ClickFix Win+R paste payload that loads the initial loader DLL. Also covers WebDAV DLL loads from any of the campaign's known delivery domains including community-observed NetSupport staging infrastructure.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.001, T1218.011, T1036.005
  • Data sources: sysmon, windows_security, edr_process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\rundll32.exe" ParentImage="*\\cmd.exe" CommandLine="*rundll32*" CommandLine="*#1*" (CommandLine="*\\leaguejazire*" OR CommandLine="*\\riyazinikokar*" OR CommandLine="*\\feinmotorik*" OR CommandLine="*\\myrtler*" OR CommandLine="*stunned-amniotic*" OR CommandLine="*cedar2glanz*" OR CommandLine="*dubbedmuch*" OR CommandLine="*paternal-angrily*" OR CommandLine="*quorashift*" OR CommandLine="*propertyfind*")) | eval webdav_path=if(match(CommandLine,"\\\\"),replace(CommandLine,"^.*?\\\\\\\\([^\\]+).*$","\1"),"local") | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, Image, CommandLine, webdav_path, ParentImage | where count <= 5 | eval alert_type="WebDAV_Rundll32_Extensionless_DLL" | table _time, ComputerName, Image, CommandLine, webdav_path, ParentImage, count, alert_type | sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "rundll32.exe"
    and InitiatingProcessFileName =~ "cmd.exe"
    and ProcessCommandLine has "rundll32"
    and ProcessCommandLine has "#1"
    and (ProcessCommandLine has_any ("leaguejazire", "riyazinikokar", "feinmotorik", "myrtler", "stunned-amniotic", "cedar2glanz", "dubbedmuch", "paternal-angrily", "quorashift", "propertyfind"))
| extend WebDAV_Domain = extract(@"\\\\([^\\]+)\\.", 1, ProcessCommandLine)
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Count=count() by DeviceName, ProcessCommandLine, WebDAV_Domain, InitiatingProcessFileName
| where Count <= 5
| project Timestamp=LastSeen, DeviceName, ProcessCommandLine, WebDAV_Domain, InitiatingProcessFileName, Count, AlertType="WebDAV_Rundll32_Extensionless_DLL"
| sort by Timestamp desc

Sigma

title: WebDAV Rundll32 Execution of Extension-Less DLL via ClickFix
id: 7a1e3b8c-9d4f-4a2e-8b7c-6f5d3e2a1b0c
status: experimental
description: Detects 32-bit rundll32.exe executing an extension-less or WebDAV-hosted DLL by ordinal #1, indicative of the ClearFake ClickFix/WebDAV execution chain. The command is reconstructed via cmd.exe delayed-expansion and loaded from a WebDAV UNC path. Campaign domains include leaguejazire.com, riyazinikokar.xyz, plus community-observed NetSupport staging infrastructure.
references:
    - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
    - https://guard.io/labs/etherhiding-hiding-web2-malicious-code-in-web3-smart-contracts
author: Threadlinqs Team
date: 2026-09-08
tags:
    - attack.execution
    - attack.t1204.001
    - attack.t1218.011
    - attack.t1036.005
    - attack.t1071.001
    - attack.tool.clearfake
logsource:
    category: process_creation
    product: windows
    definition: Sysmon EventID 1 or equivalent EDR process creation events
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ParentImage|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'rundll32'
            - '#1'
        CommandLine|contains:
            - 'leaguejazire'
            - 'riyazinikokar'
            - 'feinmotorik'
            - 'myrtler'
            - 'stunned-amniotic'
            - 'cedar2glanz'
            - 'dubbedmuch'
            - 'paternal-angrily'
            - 'quorashift'
            - 'propertyfind'
    condition: selection
falsepositives:
    - Legitimate software executed from internal WebDAV shares using extension-less DLLs
    - Internal network drive mappings with similar naming conventions
    - Rare legitimate use of rundll32 with ordinal #1 on WebDAV paths
level: critical

Known false positives:

  • Legitimate software executed from internal corporate WebDAV shares using extension-less DLLs
  • Rare enterprise use of rundll32 with ordinal #1 on administrative UNC paths

Tuning notes: Tune by excluding known corporate WebDAV servers and internal UNC paths. Lower threshold from 5 to 2 for high-security environments. Add organization-specific WebDAV delivery servers to the allowlist if legitimate use is confirmed. Monitor for rundll32.exe with extension-less DLL arguments from any WebDAV path, even if the domain is not in the campaign list.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • DLL Side-Loading via Signed Chrome Component Platform_Experience_Helper and Malicious [indicator] · unlock with TL Creds
  • BYOVD EDR-Killer Abuse — [indicator] IOCTL 0x2205c0 Process Termination · unlock with TL Creds
  • NetSupport Manager RAT — Unauthorized Installation with Hidden Config and Scheduled Task Persistence · unlock with TL Creds
  • ZigCryptoStealer Process Injection into Suspended Explorer.exe with Clipboard Hijacking · unlock with TL Creds
  • Amatera Stealer Post-Exploitation — Bulk Credential, Wallet, and Password Manager Collection · unlock with TL Creds
  • Go Reverse TCP Proxy — Yamux Protocol Tunneling via WebSocket Secure to Campaign C2 · unlock with TL Creds
  • Suspicious PowerShell Execution with WebClient Download and IEX of Obfuscated Remote Script · unlock with TL Creds
  • Amatera Stealer C2 Communication via Encrypted Protocol and Dead-Drop Resolver · unlock with TL Creds

Indicators of compromise

As of 2026-09-08, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-2387.

Sample indicators (3 of 33)

  • IP address: 145.249.109[.]147
  • Domain: leaguejazire[.]com
  • URL: hxxps://telegra[.]ph/Functions-04-03

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

33 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The chain delivers Amatera (ACR) stealer 4.1.5-alpha alongside two divergent secondary payloads: a Zig-language cryptocurrency clipboard hijacker (ZigCryptoStealer) plus a Go reverse TCP proxy (Yamux), or an unauthorized NetSupport Manager 12.44 RAT instance with a BYOVD EDR-killer driver (DCRCVDrv.sys, IOCTL 0x2205c0). The "verification.google" branch is attributed with moderate confidence to Russian threat actor UAT-10820 running a financial credentials-and-cryptocurrency operation.

In April 2026, Cisco Talos observed an unusual WebDAV DLL execution in endpoint telemetry from a Ukrainian government organization: the remote file "verification.google" was launched by 32-bit rundll32.exe. Boarding that pivot revealed two parallel delivery chains using the same ClickFix/WebDAV execution pattern, two distinct DLL loaders, and two Amatera (ACR) stealer payloads. The attacks are assessed with moderate confidence as not targeted at a particular organization, but rather a broad credentials-and-cryptocurrency stealing operation; the "verification.google" branch is attributed with moderate confidence to a Russian threat actor tracked as UAT-10820, based on the NetSupport C2 gateway IP residing in Russia.

The infection chain begins with a compromised legitimate website onto which an unauthorized Cloudflare Worker has been deployed. The Worker injects malicious JavaScript that uses EtherHiding: it makes JSON-RPC eth_call queries to a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) via the public RPC endpoint bsc-testnet-rpc[.]publicnode[.]com, retrieving next-stage code from immutable blockchain storage. The script checks for headless-browser environments, identifies the OS, and pulls OS-specific stage-2 code from contract 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff (Windows) or 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5 (macOS). It assigns the victim a tracking cookie (cjs_id), queries an on-chain goal tracker, and overlays a convincing fake Google reCAPTCHA checkbox. Clicking it triggers a ClickFix prompt instructing the user to press Win+R, paste the clipboard, and press Enter. The pasted command uses delayed-expansion to reconstruct pushd/rundll32/popd at execution time and loads a WebDAV DLL (e.g., pf.ch or verification.google) from a randomized subdomain of leaguejazire[.]com (Windows) — or a curl variant against riyazinikokar[.]xyz (macOS) — invoking it via rundll32.exe ordinal #1.

The "pf.ch" loader is a packed 32-bit DLL exporting only "moor", using vectored exception handling, XOR loops, API hashing, and obfuscated control flow; a thread waits on a "hit" event, then copies an embedded blob into memory and transfers control via Windows fibers. The final Amatera payload (build label 4.1.5-alpha, string GETWELLV2) is XOR+LZNT1-decoded, walks module export tables to resolve APIs, and executes 32-to-64-bit transitions (direct WoW64 syscall stubs) to bypass EDR user-mode hooks. Amatera communicates over an ECDH + ChaCha20-Poly1305 encrypted protocol, decrypts its configuration via Base64 then XOR (key 852149723) into JSON, and resolves its C2 through a Telegraph dead-drop page (telegra[.]ph/Functions-04-03) to 145.249.109[.]147:443 (pf.ch branch) or a fixed encrypted address 45.150.34[.]2:443 presented with github[.]com as the TLS SNI (verification.google branch). Its configuration lists 400+ collection entries: browser/profile data, Telegram/Signal/WhatsApp, 100+ desktop wallet locations, KeePass/Bitwarden/1Password/RoboForm/NordPass, WinAuth/Authy, FileZilla, AnyDesk, NordVPN/AzireVPN, and file-grabber rules for Desktop/Downloads/Documents/Recent targeting .kdbx, .p12, .pfx, .pem and 100+ other private-key/wallet/2FA patterns. A secondary-payload tasking mechanism (ld array) supports executables, DLLs, PowerShell, raw shellcode, and MSI in file or fileless modes.

Secondary payloads diverge by branch. The "pf.ch" chain delivers a ZIP (279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92) containing the legitimate signed Google Chrome component platform_experience_helper.exe and a malicious Secur32.dll it sinks (DLL side-loading via the GetUserNameExW import). The .NET NativeAOT loader decrypts and loads two PEs: ZigCryptoStealer (written in the Zig language), which spawns C:\Windows\explorer.exe suspended, manually maps its PE into the child, restores the thread context and resumes it (process injection), then polls the clipboard and swaps recognized cryptocurrency addresses for attacker-controlled wallets, exfiltrating the original addresses. It queries BNB Smart Chain via bsc[.]rpc[.]blxrbdn[.]com disguised as an ERC-20 balance check against contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468, whose setData(string) function returns the current C2 domain (39 C2 rotations between March 16 and July 26; recent values include static[.]quorashift[.]cc and lb[.]propertyfind[.]cc, both behind Cloudflare). The second PE is the signed but vulnerable kernel driver DCRCVDrv.sys (MOCOMSYS/DCRC, device \Device\DCRCVDRV_U) whose IOCTL 0x2205c0 terminates an arbitrary process PID with no caller authorization — a BYOVD EDR-killer used to kill security processes enumerated by name hash. The same chain also stages a fileless Go reverse TCP proxy (shellcode 643ef355...; unpacked 1819827e17...) that opens a WebSocket Secure session to update[.]dubbedmuch[.]cc/, reads the MachineGuid and hostname, and multiplexes bidirectional relay streams via HashiCorp Yamux (protocol tunneling).

The "verification.google" loader uses dynamically resolved TpAllocWork callbacks inside a large control-flow-flattening loop, decodes runtime syscall numbers for direct WoW64 stubs, and hollows a clean in-memory dbghelp.dll (module stomping) before pivoting to the Amatera payload. Its NetSupport Manager task is downloaded as PowerShell from kr[.]cedar2glanz[.]ru/jewel[.]js (IEX, fileless). The staging script enforces strict anti-analysis gates (C: volume serial check against 4E014A2F, uptime below 10 minutes aborts, a native NtDelayExecution timing measurement, CPU count, 3.2 GiB RAM floor, 384 MiB VRAM floor, and 36 display-adapter fingerprints), derives an install path from a hash of MachineGuid|zdozwoqx3c, and generates decoy HTTPS traffic from background runspaces to GitHub, npm, Docker Hub, PyPI, NuGet, and the PowerShell Gallery. The final ZIP (bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b) is fetched from phys[.]stunned-amniotic[.]com/hub[.]log and extracted to %APPDATA%; hypersnap.exe (a renamed signed NetSupport Manager 12.44 client32.exe) runs hidden, calls the _NSMClient32@8 export in PCICL32.DLL, and persists via a scheduled task at user logon. NetSupport client32.ini hides the tray and disables visible controls, and the client polls the HTTP gateway paternal-angrily[.]com:443 (212.118.56[.]166, Russia) every 60 seconds. The NetSupport license (KAKAN, serial NSM789508) matches licenses seen in both the EVALUSION and IClickFix campaigns. G DATA and Trend Micro independently documented adjacent EtherHiding/Amatera ClearFake chains (SectopRAT + ACRStealer; HijackLoader + ACRStealer) showing the same contracts, but Talos found no common infrastructure tying those campaigns to this one.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1055.001 Dynamic-link Library Injection; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1204.001 User Execution: Malicious Link

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography

stealth

T1218.011 System Binary Proxy Execution: Rundll32

Credential Access

T1555.005 Credentials from Password Stores: Password Managers

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

  • Block the WebDAV domains leaguejazire.com and riyazinikokar.xyz and alert on rundll32.exe execution with UNC/WebDAV path arguments
  • Block/blocksink outbound JSON-RPC eth_call traffic to bsc-testnet-rpc.publicnode.com and bsc.rpc.blxrbdn.com and flag browser calls to unknown BSC contracts
  • Block the C2 domains (static.quorashift.cc, lb.propertyfind.cc, update.dubbedmuch.cc, paternal-angrily.com, phys.stunned-amniotic.com, kr.cedar2glanz.ru) and C2 IPs (145.249.109.147, 45.150.34.2, 212.118.56.166)
  • Hunt for and remove unauthorized NetSupport Manager installations (hypersnap.exe / client32.exe, client32.ini, PCICL32.DLL) and the logon-triggered scheduled task
  • Check for DCRCVDrv.sys (legacy service DCRCVDRV_U), the \.\DCRCVDRV_U device, and IOCTL 0x2205c0 abuse; add the driver to the vulnerable-driver block list
  • Disable the Windows WebClient service on workstations that do not require WebDAV

Workarounds

  • Restrict user access to the Windows Run dialog and WebDAV execution on managed endpoints
  • Filter etag/extension-less DLL execution; require digital-signature validation for DLL loads over WebDAV

Longer-term hardening

  • Enforce EDR with behavioral detection for user-mode hook evasion (direct WoW64 syscalls), module stomping, and process injection into suspended processes
  • Add DCRCVDrv.sys certificate and hashes to the WDAC/HVCI driver-block policies; monitor for unexpected kernel driver loading
  • Deploy enterprise browser policy restricting clipboard-write access and blocking fake-CAPTCHA prompt surfaces on untrusted sites
  • Security-awareness training targeting ClickFix/fake-CAPTCHA and 'paste into Run dialog' social engineering
  • Correlate the shared NetSupport license (KAKAN / NSM789508) with EVALUSION/IClickFix detections

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Windows hosts with WebClient/WebDAV enabled
  • NetSupport — NetSupport Manager (client32.exe 12.44)
    Vulnerable versions: 12.44
  • MOCOMSYS & DCRC — NEOVM / DCRCV_U kernel driver (DCRCVDrv.sys)
    Vulnerable versions: DCRCV_U driver (compiled 2022-12-16, IOCTL 0x2205c0)
  • Google — Chrome (platform_experience_helper.exe)
    Vulnerable versions: legitimate signed component abused for Secur32.dll side-loading

Timeline

  • Guardio Labs publicly discloses the EtherHiding technique: malicious JavaScript stored in BNB Smart Chain contracts, retrieved via free, untraceable eth_call RPC.
  • JUMPSEC/CSIDE deep-dive documents an EtherHiding-hosted ClickFix campaign across ~19,800 compromised WordPress sites using BSC smart contracts ('Orchid' contract) to push Windows payloads.
  • EVALUSION clickfix campaign (eSentire) delivers a PureCrypter-packed Amatera DLL and NetSupport RAT; NetSupport license KAKAN / serial NSM789508 observed — later found in this campaign.
  • ZigCryptoStealer's BNB Smart Chain configuration contract (locked-ioc-8) begins receiving C2 domain updates; 39 setData() rotations occur through July 26.
  • Talos observes 'locked-ioc-18' WebDAV DLL executed by 32-bit rundll32.exe at a Ukrainian government organization, pivoting to the two-chain ClearFake investigation.
  • Trend Micro documents a parallel ClearFake campaign using the same Windows/macOS BSC contracts (0x46790e2A..., 0x68DcE15C...) delivering SectopRAT + ACRStealer via a single deployer wallet.
  • ZigCryptoStealer C2 rotates to fd[.]gstats-api-contact[.]cc (active June 30 - July 5).
  • ZigCryptoStealer C2 rotates to locked-ioc-14 (July 18-26); Umbrella DNS shows queries from 38 countries, top origins US, Indonesia, Brazil, India, Egypt.
  • Malwarebytes reports fake game downloads abusing RenPy loader, MSBuild and EtherHiding (BSC contract 0x328a1fad...) to deliver an obfuscated Amatera Stealer sample.
  • ZigCryptoStealer C2 rotates to locked-ioc-19 (July 26-30) with queries from 98 countries; all six campaign C2 domains resolve through shared Cloudflare addresses.
  • Cisco Talos publishes the full technical analysis of the ClearFake WebDAV chain: two loaders, two Amatera 4.1.5-alpha payloads, ZigCryptoStealer + BYOVD + Go Yamux proxy and NetSupport Manager 12.44; attributes the 'locked-ioc-18' branch to UAT-10820 (Russian, moderate confidence).

Sources cited

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats