Threat video1:00
CNCMachineRMS RAT via ClickFix: Detection & IOCs
A fake CAPTCHA lure side-loads the CNCMachineRMS RAT, which reaches C2 over TCP 443: 29 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for CNCMachineRMS RAT via ClickFix: Detection & IOCs →
Chapters
- 0:00The hookFake CAPTCHA drops a RAT: 18 techniques.
- 0:04The storyVictims paste a command into Run.
- 0:11Attack pathThe command fetches an HTA file.
- 0:25AttributionAttributed to SmartApeSG.
- 0:30Indicators of compromise25 indicators to hunt: 5 IPs, 4 domains and 3 URLs, and more.
- 0:37MITRE ATT&CK techniques18 ATT&CK techniques, from execution to command and control.
- 0:43Remediation8 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake CAPTCHA drops a RAT: 18 techniques.
0:05Victims paste a command into Run.
0:07LevelBlue tracks the chain as BabaDeda.
0:11The command fetches an HTA file.
0:13It downloads a zip disguised as PDF.
0:16The archive side-loads the RAT.
0:19Beacons go to the command server over non-TLS traffic.
0:26Attributed to SmartApeSG. Confidence: low.
0:3125 indicators to hunt: 5 IPs, 4 domains and 3 URLs, and more.
0:3818 ATT&CK techniques, from execution to command and control.
0:438 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.