NetSupport Manager RAT
NetSupport Manager RAT is a maliciously repurposed deployment of the legitimate NetSupport Manager remote access tool used by attackers to obtain unauthorized remote control of infected Windows systems. The provided content links it to multiple delivery chains. In SmartApeSG ClickFix activity observed in 2026, victims were socially engineered by fake verification/CAPTCHA pages into executing malicious scripts; an initial unidentified RAT then communicated over encoded non-SSL traffic on TCP/443 and downloaded a second-stage malicious NetSupport Manager RAT package. In that chain, a CAB archive was fetched and installed via C:\ProgramData\processor.vbs and C:\ProgramData\token.bat, which extracted setup.cab to C:\ProgramData\UpdateInstaller, established persistence so NetSupport would run after reboot, and then deleted staging files. Reported infrastructure for this activity included initial RAT C2 89.110.110[.]119:443, NetSupport RAT C2 185.163.47[.]217:443, SmartApeSG URLs under hiddenplanetlab[.]top, ClickFix/script infrastructure at 178.156.165[.]82, 178.156.173[.]194, and hxxps://silverharvestnetwork[.]com/check. Associated hashes included 1514b1268e9dc6d2f37137aa38c756cb4bf8186ac9235d6863b78e7f8bbbe976 (initial RAT ZIP), 469bac8e10f50263e8ff0806e6ba126bb4cc660799129a8653eab3f8ec7201e5 (processor.vbs), 9c7eda2c4d3aaa8746495741bef57a07de180f0409409faf0f91658e88ba33f5 (token.bat), and 7ba5481c873bb3081442561f749f590badd72ef249fddfe993e30b28dc0c2112 (setup.cab). The content also states NetSupport Manager RAT appeared in SmartApeSG activity documented in November 2025. Separately, Red Canary reporting on 2023 MSIX abuse describes a FIN7-linked cluster using malicious MSIX packages, where StartingScriptWrapper.ps1 launched PowerShell that used process injection to execute POWERTRASH and Carbanak, which then delivered NetSupport Manager RAT as a follow-on payload. Those campaigns used malvertising/SEO-poisoning lures impersonating software such as Grammarly, Microsoft Teams, Notion, and Zoom, affected organizations across multiple industries, and included NetSupport binaries with metadata referencing "Crosstec Corporation" instead of "NetSupport Corporation." Additional content describes ClickFix campaigns using the legacy finger command and anti-analysis checks that, when no analysis tools were found, delivered a PDF-spoofing ZIP archive containing a NetSupport Manager RAT package.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
When victims open these MSIX packages, the StartingScriptWrapper.ps1 component launches embedded PowerShell scripts that employ process injection to execute POWERTRASH and Carbanak malware, which subsequently deliver NetSupport Manager RAT.
My previous in-depth diary about a SmartApeSG (ZPHP, HANEYMANEY) was in November 2025, when I saw NetSupport Manager RAT.
Techniques & procedures
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
4 techniquesVictims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
MITRE ATT&CK Mapping Technique ID Context Obtain Capabilities: Tool T1588.002 Legitimate NetSupport Manager repurposed as RAT
MITRE ATT&CK Mapping Technique ID Context Obtain Capabilities: Digital Certificates T1588.004 Stolen/cracked NSM license (2015 vintage)
Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.
Initial Access
1 techniqueMITRE ATT&CK Mapping Technique ID Context Phishing: Spearphishing Attachment T1566.001 Freight rate confirmation and government lure filenames
Execution
7 techniquesA batch script called token.bat handles the extraction and installation, while a VBScript file called processor.vbs triggers the batch script.
Defenders are advised to monitor for unusual PowerShell execution tied to browser events, as this is a clear sign of the ClickFix technique being abused.
A batch script called token.bat handles the extraction and installation... Together, these components install the NetSupport RAT and configure it to run automatically whenever the system restarts.
A VBScript file called processor.vbs triggers the batch script.
The page copies a PowerShell command to the victim's clipboard and instructs them to press Win+R, Ctrl+V, Enter. Standard ClickFix technique -- the victim executes the malware themselves, bypassing email attachment scanning, download warnings, and Mark-of-the-Web protections.
Since mid-2023, multiple threat actors have been observed abusing MSIX files to deliver various malware payloads... When victims open these MSIX packages...
Persistence
3 techniquesCreates Client.lnk in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ via WScript.Shell COM object — T1547.001
Privilege Escalation
5 techniquesCreates Client.lnk in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ via WScript.Shell COM object — T1547.001
Stealth
9 techniquesThat loader uses variable indirection to construct the string iex : sv o ie # $o = 'ie' .((gv o).Value + 'X') # invoke ('ie' + 'X') = iex
MITRE ATT&CK Mapping Technique ID Context Obfuscated Files: Software Packing T1027.002 PyInstaller packing; XOR encryption with StagerKey16Bytes
a dual-lure NetSupport Manager RAT operation... A CS2 "Iridia Cheats" lure at iridiacheats.dev ... A "Polymarket Smart Money Scanner" whale-tracker lure at polymarketscanner.dev
Registers as "Windows Update Assistant" (v10.0.19045.3448, "Microsoft Corporation") — T1036.005
After the NetSupport RAT is installed and made persistent on the host, the scripts used to set it up are deleted automatically, removing traces of the initial compromise.
fal.php drops NetSupport Manager 12.01 with a v10.60 loader stub, installs into %LOCALAPPDATA%\NetService\, launches Service.exe through explorer.exe for PPID spoofing
Collection
1 techniquedownloads gggs.7z (pw: falos), lin.7z (pw: ilil), 7z.exe, 7z.dll
Command and Control
5 techniquesThe first stage drops an unidentified RAT that sends encoded traffic to its C2 server over TCP port 443, making it blend in with regular web traffic.
MITRE ATT&CK Mapping Technique ID Context Application Layer Protocol: Web T1071.001 HTTP gateway ( /fakeurl.htm , /testpage.htm )
Once the script runs, it silently reaches out to attacker-controlled servers and pulls down the first stage of the infection... The script then contacts attacker infrastructure to fetch a ZIP archive containing the initial RAT package from a remote server.
Once the initial RAT is in place, it pulls in a second payload: a malicious package of NetSupport Manager RAT, a legitimate remote access tool that attackers have repurposed to take unauthorized control of infected machines.
MITRE ATT&CK Mapping Technique ID Context Encrypted Channel: Asymmetric Crypto T1573.002 HTTPS C2 on port 443 (custom NSM protocol)
IOCs tracked for this family
83 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A legitimate remote access tool repurposed by attackers as a persistent remote access trojan. In this campaign it is delivered as the second-stage payload, installed via CAB/batch/VBScript components, configured for persistence, and used to take unauthorized control of infected Windows hosts.
Remote access trojan delivered as a malicious NetSupport Manager package after an initial unidentified RAT infection; the package is installed via scripts and made persistent on the infected Windows host.
Remote access trojan previously observed in SmartApeSG campaign activity before the campaign more consistently shifted to Remcos RAT.
NetSupport Manager RAT is a legitimate remote administration tool that is often abused by threat actors as a remote access trojan to gain persistent access and control over compromised systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.