GrayCharlie
GrayCharlie is a financially motivated threat actor active since mid-2023 that compromises WordPress websites and injects malicious, externally hosted JavaScript to profile visitors and redirect them to malware delivery lures. The actor overlaps with the previously tracked SmartApeSG cluster, also referred to as ZPHP or HANEYMANEY/HANEMONEY. Operations observed include a supply-chain-style campaign impacting U.S. law firms: at least fifteen law firm WordPress sites were injected with identical JavaScript pointing to the same attacker-controlled domain, and reporting assessed the compromises may have occurred via a shared IT/marketing provider—specifically a suspected supply-chain vector involving SMB Team (an IT services/law-firm acceleration provider) and/or a shared WordPress/plugin stack. GrayCharlie’s infection chains rely on social engineering via fake browser update pages (mimicking Chrome/Edge/Firefox) and ClickFix-style fake CAPTCHA prompts that instruct users to execute attacker-provided commands (e.g., via the Windows Run dialog). Delivery tradecraft described includes WScript spawning PowerShell to download and extract a NetSupport RAT client into %AppData%, and a ClickFix chain that retrieves a batch file, installs the RAT, and establishes persistence via a Registry Run key. Primary payloading centers on NetSupport RAT for interactive access, surveillance, and file operations, with follow-on delivery of additional malware including the Stealc infostealer and (more rarely) SectopRAT (including observed DLL sideloading). Infrastructure analysis attributed much of GrayCharlie’s supporting ecosystem (NetSupport RAT C2 and staging) to MivoCloud and HZ Hosting Ltd (AS202015). Two main NetSupport RAT C2 clusters were reported, differentiated by TLS certificate naming patterns and NetSupport license/serial identifiers; C2 management commonly used TCP/443, with higher-tier administration infrastructure accessed mainly over SSH. Some higher-tier activity suggested at least some operators are Russian-speaking. The United States was reported as the most frequent target, though activity spans multiple industries globally.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
20 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Compromise of WordPress sites via injected external JavaScript for visitor profiling and malware delivery, using fake update lures/ClickFix-style prompts; infections linked to NetSupport tooling followed by Stealc and SectopRAT.
Financially motivated supply-chain style campaign leveraging compromised WordPress sites of U.S. law firms (likely via a shared IT/marketing provider) to inject malicious JavaScript that redirects victims to fake browser updates or fake CAPTCHAs, coercing execution of a PowerShell command via the Windows Run dialog to install NetSupport RAT; subsequently used for surveillance/file operations and to deliver Stealc infostealer and SectopRAT.
Compromises WordPress sites to inject malicious JavaScript that profiles visitors and delivers social-engineering lures (fake browser updates and ClickFix-style fake CAPTCHAs) to get users to execute payloads, primarily deploying NetSupport RAT and additional stealers/RATs. Activity includes supply-chain compromise of an IT services provider to reach multiple US law firms.
Compromises WordPress sites to redirect traffic to fake browser-update pages to deliver remote access trojans (RATs).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.