# SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT via HTA and DLL side-loading

> A SmartApeSG ClickFix campaign shows a fake CAPTCHA page that tricks victims into pasting a command into the Windows Run window. The command retrieves an HTA, which downloads a zip disguised as a PDF; the zip side-loads the CNCMachineRMS RAT, which talks to C2 87.199.205.61 over TCP 443 using non-TLS encoded traffic. LevelBlue SpiderLabs tracks the CNCMachineRMS chain as 'BabaDeda'.

- **Published:** 2026-11-13T00:57:11Z
- **Last reviewed:** 2026-11-13T00:57:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5909
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5909.png
- **ID:** TL-2026-5909
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SmartApeSG
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

On 2026-11-12 Malware-Traffic-Analysis.net published a PCAP, IOCs and files for a SmartApeSG ClickFix infection that ends in the CNCMachineRMS remote access trojan. SmartApeSG (also reported as ZPHP / HANEYMANEY) injects scripts into compromised legitimate websites to display a fake CAPTCHA 'verify you are human' page. In this case three JavaScript/web resources are fetched from cashewminaret.org (/identity/reset-layout.js, /identity/middleware-build, /identity/gateway-dom.js) and the page injects ClickFix text instructing the victim to paste it into the Windows Run dialog.

The pasted command retrieves an HTA file (40,301 bytes) from https://orchardandbarite.com/spa and saves it as C:\Users\<user>\AppData\Local\NHEWS.hta. The HTA downloads a 73.9 MB zip archive from https://orchardandbarite.com/gross and stores it as C:\Users\<user>\AppData\Local\Microsoft\Windows\packwindata\packwindata.pdf (a zip with a .pdf extension). The archive is a DLL side-loading package that loads the CNCMachineRMS RAT. Post-infection, the RAT communicates with 87.199.205.61 over TCP 443 using encoded traffic that is not TLS. The post does not publish the archive password and does not map ATT&CK techniques; the mapping in this record is analyst-derived.

CNCMachineRMS was documented by LevelBlue SpiderLabs (Rodel Mendrez, 2026-08-10) as a previously undocumented x64 RAT delivered at the end of a 'BabaDeda' loader chain (name from the 0xBABADEDA idempotency magic). In the LevelBlue sample, a ClickFix lure launches the legitimately signed IBM SPSS WinWrapIDE.exe, which loads decoy DLLs (wwide9.dll, ClLoca.dll, Xceed.Wpf.DataGrid.dll, ComPDFKit.Viewer.dll); the last writes noise-padded shellcode and runs it as the callback to EnumTimeFormatsEx. The shellcode reads model.dat and HelperStandardizationApplication.bin, whose obfuscated (not encrypted) config embeds the ~1.14 MB RAT. Persistence uses up to seven mechanisms, including a Run key or scheduled task named 'IBM SPSS WinWrap Basic IDE' (schtasks /SC ONLOGON /RU SYSTEM /RL HIGHEST) and a scripted task re-asserting persistence every 150 seconds. The RAT offers an interactive shell, file manager, screen capture, host profiling (domain, SID, elevation, BIOS/motherboard serials, installed AV), local account creation and privileged-group addition (event IDs 4720/4732), a custom scripting language and 20 typed commands for staging further payloads. It beacons every 600 seconds (60 s retry), resolves C2 domains via DNS over HTTPS (dns.google, cloudflare-dns.com, dns.quad9.net), strings are stack-built and APIs resolved by hash; creating C:\Intel disables its VM check. Netresec (Erik Hjelmvik, 2026-08-21) found the C2 protocol is a custom binary protocol on TCP 443 without TLS, with fixed-offset runs of 0x00/0xff bytes and no known IDS signatures at publication.

Attribution caveat: the hunt source states LevelBlue 'appears' to track this SmartApeSG ClickFix chain as BabaDeda; independent sources do not establish that SmartApeSG and the BabaDeda operators are the same actor, and no nation-state or named actor attribution exists. Earlier SmartApeSG reporting (SANS ISC) shows the same ClickFix lure delivering Remcos, NetSupport RAT, StealC and Sectop RAT, and in May 2026 an unidentified RAT with encoded non-TLS port-443 traffic, consistent with CNCMachineRMS. BeaconBeagle lookups for the C2 IP returned HTTP 502 on two attempts, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1218.005 System Binary Proxy Execution: Mshta
- T1036 Masquerading
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1027.007 Obfuscated Files or Information: Dynamic API Resolution
- T1106 Native API
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1136.001 Create Account: Local Account
- T1098 Account Manipulation
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1113 Screen Capture
- T1059 Command and Scripting Interpreter
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1497 Virtualization/Sandbox Evasion

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SmartApeSG ClickFix Run-Dialog Mshta/HTA Delivery of CNCMachineRMS — Exploitation Phase** (`TL-2026-5909-SPL-001`)

Detects the SmartApeSG ClickFix execution step: a command pasted into the Windows Run dialog starts mshta.exe (parent explorer.exe) against a remote HTA, or any process command line referencing the dropped NHEWS.hta, orchardandbarite.com or cashewminaret.org. This is the user-assisted entry point of the CNCMachineRMS/BabaDeda chain (TL-2026-5909).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1218.005, T1059
- **Data sources:** sysmon, Microsoft Defender for Endpoint DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
    ( ((Image="*\\mshta.exe" OR OriginalFileName="MSHTA.EXE") (CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*.hta*"))
      OR CommandLine="*NHEWS.hta*" OR CommandLine="*orchardandbarite.com*" OR CommandLine="*cashewminaret.org*" )
```SmartApeSG ClickFix: Run-dialog command spawns mshta.exe (parent explorer.exe) or touches NHEWS.hta / orchardandbarite.com```
| eval is_mshta=if(match(Image,"(?i)mshta\\.exe$"),1,0)
| eval run_dialog_parent=if(match(ParentImage,"(?i)explorer\\.exe$"),1,0)
| eval ioc_hit=if(match(CommandLine,"(?i)orchardandbarite\\.com|nhews\\.hta|cashewminaret\\.org"),1,0)
| where ioc_hit=1 OR (is_mshta=1 AND run_dialog_parent=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines max(ioc_hit) as ioc_hit by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User ParentImage Image command_lines parent_command_lines ioc_hit count
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ((FileName =~ "mshta.exe" or ProcessVersionInfoOriginalFileName =~ "MSHTA.EXE")
        and ProcessCommandLine has_any ("http://", "https://", ".hta"))
        or ProcessCommandLine has_any ("NHEWS.hta", "orchardandbarite.com", "cashewminaret.org")
| extend IocHit = ProcessCommandLine has_any ("NHEWS.hta", "orchardandbarite.com", "cashewminaret.org")
| extend RunDialogParent = InitiatingProcessFileName =~ "explorer.exe"
| where IocHit or (FileName =~ "mshta.exe" and RunDialogParent)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IocHit, SHA256
```

### Sigma

```yaml
title: SmartApeSG ClickFix Run Dialog Launching Mshta or HTA Download (CNCMachineRMS)
id: 6f1c2a54-3b7e-4d1a-9c52-8a0e7d4b1f01
status: experimental
description: Detects mshta.exe fetching a remote HTA or being started by explorer.exe (Run dialog) and any command line referencing the SmartApeSG HTA delivery artifacts NHEWS.hta, orchardandbarite.com or cashewminaret.org.
references:
    - https://www.malware-traffic-analysis.net/2026/11/12/index.html
    - https://levelblue.com/blogs/spiderlabs-blog/cncmachinerms-the-undocumented-rat-at-the-end-of-a-babadeda-chain
    - https://www.netresec.com/?page=Blog&month=2026-08&post=CNCMachineRMS-C2-Protocol
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.execution
    - attack.t1204.004
    - attack.defense_evasion
    - attack.t1218.005
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '.hta'
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_ioc:
        CommandLine|contains:
            - 'NHEWS.hta'
            - 'orchardandbarite.com'
            - 'cashewminaret.org'
    condition: (selection_mshta and selection_parent) or selection_ioc
falsepositives:
    - Users double-clicking a legitimate .hta application
    - Legacy intranet apps launched through mshta.exe with an internal URL
level: high

```

**Known false positives:**

- Legitimate HTA-based internal tools launched from explorer.exe
- IT scripts that call mshta.exe with an internal URL

**Tuning notes:** Exclude known internal HTA hosts and signed admin tooling by CommandLine. Keep the ioc_hit branch unfiltered. Pair with a NoRun policy and an ASR rule blocking mshta.exe to reduce exposure. Extend the ioc regex with new SmartApeSG domains as they are published.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CNCMachineRMS Payload Staging and State File Artifacts — Exploitation Phase (locked: unlock with TL Creds)
- Local Account Creation and Administrators Group Add by CNCMachineRMS — Post-Exploitation Phase (locked: unlock with TL Creds)
- DNS-over-HTTPS Resolver Use by Non-Browser Process (CNCMachineRMS) — C2 Phase (locked: unlock with TL Creds)
- SmartApeSG ClickFix Delivery Domain Access — Exploitation Phase (locked: unlock with TL Creds)
- CNCMachineRMS Persistence Task or Run Key 'IBM SPSS WinWrap Basic IDE' — Post-Exploitation Phase (locked: unlock with TL Creds)
- CNCMachineRMS C2 Domain and Community Sibling DNS Lookups — C2 Phase (locked: unlock with TL Creds)
- WinWrapIDE.exe DLL Side-Loading of CNCMachineRMS (BabaDeda) — Post-Exploitation Phase (locked: unlock with TL Creds)
- CNCMachineRMS C2 over TCP 443 and 600-Second Beaconing — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `87.199.205[.]61`
- Domain: `cashewminaret[.]org`
- File hash: `2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware-Traffic-Analysis.net - 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT](https://www.malware-traffic-analysis.net/2026/11/12/index.html)
- [LevelBlue SpiderLabs - CNCMachineRMS: The Undocumented RAT at the End of a BabaDeda Chain](https://levelblue.com/blogs/spiderlabs-blog/cncmachinerms-the-undocumented-rat-at-the-end-of-a-babadeda-chain)
- [LevelBlue - CNCMachineRMS report (PDF)](https://www.levelblue.com/hubfs/Web/Library/Documents_pdf/CNCMachineRMS.pdf)
- [Netresec - CNCMachineRMS C2 Protocol](https://www.netresec.com/?page=Blog&month=2026-08&post=CNCMachineRMS-C2-Protocol)
- [SANS ISC - SmartApeSG campaign uses ClickFix page to push NetSupport RAT](https://isc.sans.edu/diary/32474)
- [SANS ISC - ClickFix Attacks Still Using the Finger](https://isc.sans.edu/diary/32566)
- [SANS ISC - SmartApeSG campaign pushes Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2)](https://isc.sans.edu/diary/32826)
- [Aviatrix Threat Research - Unidentified RAT pushes NetSupport RAT](https://aviatrix.ai/threat-research-center/unidentified-rat-pushes-netsupport-rat-2026-06-01/)
- [SOC Prime - CNCMachineRMS Emerges at the End of a BabaDeda Attack Chain](https://socprime.com/?p=50986)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5909