SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT via HTA and DLL side-loading

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5909 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SmartApeSG ClickFix Run-Dialog Mshta/HTA Delivery of CNCMachineRMS — Exploitation Phase

Detects the SmartApeSG ClickFix execution step: a command pasted into the Windows Run dialog starts mshta.exe (parent explorer.exe) against a remote HTA, or any process command line referencing the dropped NHEWS.hta, orchardandbarite.com or cashewminaret.org. This is the user-assisted entry point of the CNCMachineRMS/BabaDeda chain (TL-2026-5909).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1218.005, T1059
• Data sources: sysmon, Microsoft Defender for Endpoint DeviceProcessEvents, windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ( ((Image="*\\mshta.exe" OR OriginalFileName="MSHTA.EXE") (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*.hta*"))
      OR CommandLine="*NHEWS.hta*" OR CommandLine="*orchardandbarite.com*" OR CommandLine="*cashewminaret.org*" )
```SmartApeSG ClickFix: Run-dialog command spawns mshta.exe (parent explorer.exe) or touches NHEWS.hta / orchardandbarite.com```
| eval is_mshta=if(match(Image,"(?i)mshta\\.exe$"),1,0)
| eval run_dialog_parent=if(match(ParentImage,"(?i)explorer\\.exe$"),1,0)
| eval ioc_hit=if(match(CommandLine,"(?i)orchardandbarite\\.com|nhews\\.hta|cashewminaret\\.org"),1,0)
| where ioc_hit=1 OR (is_mshta=1 AND run_dialog_parent=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines max(ioc_hit) as ioc_hit by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage Image command_lines parent_command_lines ioc_hit count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ((FileName =~ "mshta.exe" or ProcessVersionInfoOriginalFileName =~ "MSHTA.EXE")
        and ProcessCommandLine has_any ("http://", "https://", ".hta"))
        or ProcessCommandLine has_any ("NHEWS.hta", "orchardandbarite.com", "cashewminaret.org")
| extend IocHit = ProcessCommandLine has_any ("NHEWS.hta", "orchardandbarite.com", "cashewminaret.org")
| extend RunDialogParent = InitiatingProcessFileName =~ "explorer.exe"
| where IocHit or (FileName =~ "mshta.exe" and RunDialogParent)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocHit, SHA256

Sigma

title: SmartApeSG ClickFix Run Dialog Launching Mshta or HTA Download (CNCMachineRMS)
id: 6f1c2a54-3b7e-4d1a-9c52-8a0e7d4b1f01
status: experimental
description: Detects mshta.exe fetching a remote HTA or being started by explorer.exe (Run dialog) and any command line referencing the SmartApeSG HTA delivery artifacts NHEWS.hta, orchardandbarite.com or cashewminaret.org.
references:
    - https://www.malware-traffic-analysis.net/2026/11/12/index.html
    - https://levelblue.com/blogs/spiderlabs-blog/cncmachinerms-the-undocumented-rat-at-the-end-of-a-babadeda-chain
    - https://www.netresec.com/?page=Blog&month=2026-08&post=CNCMachineRMS-C2-Protocol
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.execution
    - attack.t1204.004
    - attack.defense_evasion
    - attack.t1218.005
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '.hta'
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_ioc:
        CommandLine|contains:
            - 'NHEWS.hta'
            - 'orchardandbarite.com'
            - 'cashewminaret.org'
    condition: (selection_mshta and selection_parent) or selection_ioc
falsepositives:
    - Users double-clicking a legitimate .hta application
    - Legacy intranet apps launched through mshta.exe with an internal URL
level: high

Known false positives:

• Legitimate HTA-based internal tools launched from explorer.exe
• IT scripts that call mshta.exe with an internal URL

Tuning notes: Exclude known internal HTA hosts and signed admin tooling by CommandLine. Keep the ioc_hit branch unfiltered. Pair with a NoRun policy and an ASR rule blocking mshta.exe to reduce exposure. Extend the ioc regex with new SmartApeSG domains as they are published.

• 🔒 CNCMachineRMS Payload Staging and State File Artifacts — Exploitation Phase · unlock with TL Creds
• 🔒 Local Account Creation and Administrators Group Add by CNCMachineRMS — Post-Exploitation Phase · unlock with TL Creds
• 🔒 DNS-over-HTTPS Resolver Use by Non-Browser Process (CNCMachineRMS) — C2 Phase · unlock with TL Creds
• 🔒 SmartApeSG ClickFix Delivery Domain Access — Exploitation Phase · unlock with TL Creds
• 🔒 CNCMachineRMS Persistence Task or Run Key 'IBM SPSS WinWrap Basic IDE' — Post-Exploitation Phase · unlock with TL Creds
• 🔒 CNCMachineRMS C2 Domain and Community Sibling DNS Lookups — C2 Phase · unlock with TL Creds
• 🔒 WinWrapIDE.exe DLL Side-Loading of CNCMachineRMS (BabaDeda) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 CNCMachineRMS C2 over TCP 443 and 600-Second Beaconing — C2 Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-5909.

Sample indicators (3 of 29)

• IP address: 87.199.205[.]61
• Domain: cashewminaret[.]org
• File hash: 2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

LevelBlue SpiderLabs tracks the CNCMachineRMS chain as 'BabaDeda'.

On 2026-11-12 Malware-Traffic-Analysis.net published a PCAP, IOCs and files for a SmartApeSG ClickFix infection that ends in the CNCMachineRMS remote access trojan. SmartApeSG (also reported as ZPHP / HANEYMANEY) injects scripts into compromised legitimate websites to display a fake CAPTCHA 'verify you are human' page. In this case three JavaScript/web resources are fetched from cashewminaret.org (/identity/reset-layout.js, /identity/middleware-build, /identity/gateway-dom.js) and the page injects ClickFix text instructing the victim to paste it into the Windows Run dialog.

The pasted command retrieves an HTA file (40,301 bytes) from https://orchardandbarite.com/spa and saves it as C:\Users\<user>\AppData\Local\NHEWS.hta. The HTA downloads a 73.9 MB zip archive from https://orchardandbarite.com/gross and stores it as C:\Users\<user>\AppData\Local\Microsoft\Windows\packwindata\packwindata.pdf (a zip with a .pdf extension). The archive is a DLL side-loading package that loads the CNCMachineRMS RAT. Post-infection, the RAT communicates with 87.199.205.61 over TCP 443 using encoded traffic that is not TLS. The post does not publish the archive password and does not map ATT&CK techniques; the mapping in this record is analyst-derived.

CNCMachineRMS was documented by LevelBlue SpiderLabs (Rodel Mendrez, 2026-08-10) as a previously undocumented x64 RAT delivered at the end of a 'BabaDeda' loader chain (name from the 0xBABADEDA idempotency magic). In the LevelBlue sample, a ClickFix lure launches the legitimately signed IBM SPSS WinWrapIDE.exe, which loads decoy DLLs (wwide9.dll, ClLoca.dll, Xceed.Wpf.DataGrid.dll, ComPDFKit.Viewer.dll); the last writes noise-padded shellcode and runs it as the callback to EnumTimeFormatsEx. The shellcode reads model.dat and HelperStandardizationApplication.bin, whose obfuscated (not encrypted) config embeds the ~1.14 MB RAT. Persistence uses up to seven mechanisms, including a Run key or scheduled task named 'IBM SPSS WinWrap Basic IDE' (schtasks /SC ONLOGON /RU SYSTEM /RL HIGHEST) and a scripted task re-asserting persistence every 150 seconds. The RAT offers an interactive shell, file manager, screen capture, host profiling (domain, SID, elevation, BIOS/motherboard serials, installed AV), local account creation and privileged-group addition (event IDs 4720/4732), a custom scripting language and 20 typed commands for staging further payloads. It beacons every 600 seconds (60 s retry), resolves C2 domains via DNS over HTTPS (dns.google, cloudflare-dns.com, dns.quad9.net), strings are stack-built and APIs resolved by hash; creating C:\Intel disables its VM check. Netresec (Erik Hjelmvik, 2026-08-21) found the C2 protocol is a custom binary protocol on TCP 443 without TLS, with fixed-offset runs of 0x00/0xff bytes and no known IDS signatures at publication.

Attribution caveat: the hunt source states LevelBlue 'appears' to track this SmartApeSG ClickFix chain as BabaDeda; independent sources do not establish that SmartApeSG and the BabaDeda operators are the same actor, and no nation-state or named actor attribution exists. Earlier SmartApeSG reporting (SANS ISC) shows the same ClickFix lure delivering Remcos, NetSupport RAT, StealC and Sectop RAT, and in May 2026 an unidentified RAT with encoded non-TLS port-443 traffic, consistent with CNCMachineRMS. BeaconBeagle lookups for the C2 IP returned HTTP 502 on two attempts, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1036 Masquerading; T1218.005 System Binary Proxy Execution: Mshta; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1098 Account Manipulation; T1136.001 Create Account: Local Account; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204.004 User Execution: Malicious Copy and Paste

Discovery

T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery

Command and Control

T1095 Non-Application Layer Protocol; T1571 Non-Standard Port

Collection

T1113 Screen Capture

Remediation

Immediate actions

• Block 87.199.205.61, 85.158.110.78, 89.110.110.119, 89.124.79.98, 144.124.242.171 and the domains cashewminaret.org, orchardandbarite.com, notepadreleased.com, triotmelon.com at the perimeter
• Hunt for NHEWS.hta, packwindata.pdf under %LOCALAPPDATA%\Microsoft\Windows\packwindata, %LOCALAPPDATA%\SProject\sp.bin, %TEMP%\CNCMachineRMS and an empty C:\Intel directory
• Isolate hosts where a Run-dialog command spawned mshta.exe or downloaded an HTA, and review for new local accounts (4720/4732) and scheduled tasks named 'IBM SPSS WinWrap Basic IDE'

Workarounds

• Block outbound DoH to dns.google, cloudflare-dns.com and dns.quad9.net from non-browser processes where feasible

Longer-term hardening

• Disable the Windows Run dialog (NoRun policy) for users who do not need it and train users on ClickFix fake CAPTCHA lures
• Restrict mshta.exe via application control (WDAC/AppLocker) or ASR rules
• Alert on signed WinWrapIDE.exe (IBM SPSS) executing outside a legitimate SPSS install path
• Monitor for non-TLS binary traffic on TCP 443 and DoH sessions to public resolvers from endpoints

Affected and fixed versions

• Microsoft — Windows (endpoints; user-assisted execution via Run dialog)
  Vulnerable versions: Windows endpoints where users can run pasted commands and mshta.exe is permitted
• IBM — SPSS WinWrapIDE.exe (legitimately signed binary abused for DLL side-loading in the LevelBlue-analyzed chain)

Timeline

• 2025-11-12 SANS ISC reports a SmartApeSG fake CAPTCHA/ClickFix page delivering NetSupport RAT; the campaign had been reported since June 2024.
• 2026-03-25 SANS ISC reports SmartApeSG chains delivering Remcos RAT, NetSupport RAT, StealC and Sectop RAT (ArechClient2).
• 2026-04-02 CNCMachineRMS C2 domain locked-ioc-21 registered (per Netresec).
• 2026-04-06 First sighting of CNCMachineRMS C2 locked-ioc-24:443 (per Netresec); last seen 2026-05-27.
• 2026-05-27 Reporting of an unidentified RAT pushed through the SmartApeSG ClickFix lure, with encoded non-TLS port-443 C2 traffic.
• 2026-08-10 LevelBlue SpiderLabs publishes CNCMachineRMS analysis, naming the BabaDeda chain and documenting WinWrapIDE.exe DLL side-loading.
• 2026-08-21 Netresec publishes the CNCMachineRMS C2 protocol analysis: non-TLS binary protocol on TCP 443, DoH-based domain resolution.
• 2026-11-12 Malware-Traffic-Analysis.net publishes PCAP, IOCs and files for a SmartApeSG ClickFix infection delivering CNCMachineRMS via HTA and DLL side-loading, with C2 locked-ioc-26:443.

Sources cited

• Malware-Traffic-Analysis.net - 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT malware-traffic-analysis.net · Research · 2026-11-12
• LevelBlue SpiderLabs - CNCMachineRMS: The Undocumented RAT at the End of a BabaDeda Chain levelblue.com · Vendor report · 2026-08-10
• LevelBlue - CNCMachineRMS report (PDF) levelblue.com · Vendor report · 2026-08-10
• SANS ISC - SmartApeSG campaign uses ClickFix page to push NetSupport RAT isc.sans.edu · Research · 2025-11-12
• SANS ISC - ClickFix Attacks Still Using the Finger isc.sans.edu · Research · 2025-12-13
• SANS ISC - SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2) isc.sans.edu · Research · 2026-03-25
• Aviatrix Threat Research - Unidentified RAT pushes NetSupport RAT aviatrix.ai · Research · 2026-06-01
• Netresec - CNCMachineRMS C2 Protocol netresec.com · Blog · 2026-08-21
• SOC Prime - CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain socprime.com · Blog · 2026-08-10

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

More from SmartApeSG

• SmartApeSG ClickFix Campaign Delivering Two-Stage RAT Infection via Fake CAPTCHA Social Engineering on Windows Hosts
• Multi-Stage NetSupport RAT Loader Using Layered Obfuscation (Decimal Arrays, AES, GZIP)
• SmartApeSG ClickFix Campaign Delivers NetSupport Manager RAT via Two-Stage Loader (Unidentified Initial RAT, Encoded TCP/443 C2)
• SmartApeSG ClickFix Campaign Delivers Remcos RAT via Fake CAPTCHA Pages

Previous and next in malware

• Fake Zillow Apartment-Review Pages Use ClickFix to Deploy NetSupport RAT Previous report
• XLoader (v8.9) infostealer delivered via purchase-order phishing DOCX exploiting CVE-2017-11882 Next report