During a recent incident response engagement, we responded to a single-host infection handed over to us by the SOC. The user downloaded a malicious “Remote Desktop Connection Manager”, a legitimate tool developed by Microsoft, but attackers were now misusing the brand. After the infection, the attackers had full access to the infected device. The RAT was ChainScript, as Nicely depicted here. [1] As soon as we took over this case, we began hunting inside the network for traces of lateral movement and/or similar techniques (TTPs, IOCs). Additionally, we found 3 additional infected computers with the same malware, with infections occurring in a short time span.

ClickFix lures deliver the ChainScript RAT, which uses a Polygon smart contract to locate active WebSocket command-and-control servers.

Blackpoint uncovers ChainScript, a Node.js RAT that queries a Polygon smart contract to find and rotate its command server. Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript. The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain. The […]

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Haz clic para acceder al contenido completo.

ClickFix lures deliver the ChainScript RAT, which uses a Polygon smart contract to locate active WebSocket command-and-control servers.

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

Threat actors are deploying a new remote access trojan called ChainScript via ClickFix lures, using a Polygon smart contract for […]

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

ClickFix詐欺キャンペーンがChainScript RATマルウェアを配布。Polygonブロックチェーンのスマートコントラクトを悪用してC2サーバーを動的に切り替え、検出回避を実現。Windows ユーザーが主な対象。

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

What is ChainScript RAT? ChainScript is a remote access trojan that first appeared in late 2023.

Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access trojan (RAT) called ChainScript. "ChainScript has appeared under multiple build names, including ComponentTask33, UpdateDigital, HostShared, and OrchidViolet66, while presenting itself as Spotify, Zoom Workplace, and Microsoft Teams software," Blackpoint Adversary Pursuit Group (APG)

Cet article présente l'analyse technique complète d'un RAT Node.js jusqu'alors non documenté, désormais suivi sous le nom ChainScript. La découverte a eu lieu lors d'une investigation sur une campagne ClickFix.