Threat reportMalwareTL-2026-4810
NetSupport Loader multi-stage obfuscated PowerShell chain (decimal array, AES-ECB, GZIP) deobfuscated with CyberChef
NetSupport Loader multi-stage obfuscated PowerShell chain (TL-2026-4810), also tracked as NetSupport Loader, is a medium-severity malware campaign, first published 2026-10-30. It has no confirmed attribution, affects Microsoft Windows (PowerShell), maps to 7 MITRE ATT&CK techniques (T1027, T1027.010, T1027.013), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4810
- Threat ID
- TL-2026-4810
- Also known as
- NetSupport Loader, NetSupport RAT loader
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- education, government administration, business services
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in NetSupport Loader multi-stage obfuscated PowerShell chain
Malware and tooling: NetSupport Loader, NetSupport RAT, NetSupportManager RAT, NetSupport Manager
How NetSupport Loader multi-stage obfuscated PowerShell chain works
Embee Research documented a NetSupport Loader sample (SHA256 befc7ebb...bfab, from Malware Bazaar) built from three chained scripts that hide the payload behind decimal-array encoding with subtraction constants, AES-ECB encryption and GZIP compression. Stage 3 reveals the Net.Webclient string, indicating download capability for the NetSupport RAT, which is a legitimate remote-administration tool widely abused by threat actors.
Embee Research (published 2024-02-26) walks through deobfuscating a NetSupport Loader sample obtained from Malware Bazaar (SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab). The sample consists of three separate scripts that are peeled apart with a 22-operation CyberChef recipe using Fork/Merge flow control and registers ($R0-$R3) to hold extracted keys and constants.
Stage 1 is a large decimal integer array inside the script. Each value has the constant 787 subtracted and is converted to an ASCII character, which yields the Stage 2 PowerShell script. Stage 2 contains a Base64 blob: a 44-character Base64 string (extracted by regex) is the AES key, the first 16 bytes of the decoded blob are used as the IV, the data is decrypted with AES in ECB mode and then GZIP-decompressed; trailing null bytes are stripped with the regex \0+$. The result is the Stage 3 PowerShell script.
Stage 3 uses four separate decimal arrays obfuscated with the same subtraction method, with the constant 4274. Decoding reveals strings such as Net.Webclient, which indicates the script performs network retrieval of the next component (the NetSupport RAT payload). The article lists no C2 domains, IPs or URLs, so network indicators are not available from this source.
NetSupport Manager is a legitimate remote administration tool that has been abused by threat actors since at least 2020 (Red Canary ranked it #4 in its 2025 Threat Detection Report). Public reporting on the wider family describes delivery through fake updates, SocGholish, loaders such as GHOSTPULSE and, in 2025, malicious copy-and-paste (ClickFix-style) lures; persistence through Run keys, Startup shortcuts and scheduled tasks; and client32.exe frequently executing from ProgramData, Downloads or Roaming rather than Program Files. These family-level behaviors are context from other sources and were not confirmed for this specific sample by the Embee write-up. Defenders should focus on detecting the obfuscation primitives (large decimal arrays with arithmetic decoding, AES/GZIP in PowerShell, Net.Webclient), unusual client32.exe execution, and unsanctioned RMM tooling.
MITRE ATT&CK techniques used in TL-2026-4810
Defense Evasion
T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1027.013 Encrypted/Encoded File; T1140 Deobfuscate/Decode Files or Information
Execution
Command and Control
Persistence
Affected products and versions in NetSupport Loader multi-stage obfuscated PowerShell chain
- Microsoft — Windows (PowerShell)
Vulnerable versions: Hosts able to execute attacker-supplied PowerShell
Remediation for NetSupport Loader multi-stage obfuscated PowerShell chain
Immediate actions
- Hunt for client32.exe executing outside Program Files (ProgramData, Downloads, AppData Roaming) and for binaries with internal name client32
- Block or alert on the SHA256 befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab
- Alert on PowerShell scripts that combine large decimal arrays, subtraction decoding, AES decryption, GZip decompression and Net.Webclient
Workarounds
- Monitor for NetSupport protocol traffic (default TCP 1412) and HTTP requests containing CMD=ENCD from non-sanctioned hosts
Longer-term hardening
- Maintain an allowlist of sanctioned RMM tools and alert on unsanctioned ones such as NetSupport Manager
- Enable PowerShell Script Block Logging and AMSI and forward the logs to the SIEM
- Constrain PowerShell with Constrained Language Mode or application control where feasible
Timeline of NetSupport Loader multi-stage obfuscated PowerShell chain
- Mandiant publishes analysis of a fake software update campaign delivering NetSupport RAT with Run-key and Startup-folder persistence
- Red Canary begins tracking malicious NetSupport Manager use (year precision; day set to 01)
- NetSupport Manager first appears in Red Canary's monthly top 10 threats (month precision; day set to 01)
- The Hacker News reports a surge in NetSupport RAT infections affecting education, government and business services via fake updates, SocGholish and GHOSTPULSE
- Embee Research publishes a CyberChef walkthrough deobfuscating a three-stage NetSupport Loader sample from Malware Bazaar
- NetSupport Manager reaches Red Canary's #1 monthly threat ranking for the first time (month precision; day set to 01)
Sources cited for NetSupport Loader multi-stage obfuscated PowerShell chain
- Advanced CyberChef Techniques For Malware Analysis - Detailed Walkthrough and Examples
- MalwareBazaar sample befc7ebbea2d04c14e45bd52b1db9427afce022d7e2df331779dae3dfe85bfab
- Fake Software Update Abuses NetSupport Remote Access Tool (Mandiant)
- NetSupport RAT Infections on the Rise (The Hacker News)
- NetSupport Manager - Red Canary Threat Detection Report
- Splunk Analytics Story: NetSupport RMM Tool Abuse
Detection coverage for TL-2026-4810
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4810 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.