Today was my last day at NetSupport! 💙 8 years of memories with some wonderful colleagues and friends and now time to make some new ones. 🫶
July 1, 2026 at 3:39 PM
Today was my last day at NetSupport! 💙 8 years of memories with some wonderful colleagues and friends and now time to make some new ones. 🫶
Are you coming to Bett? Meet me at the #NetSupportSelfie stop. NetSupport stand SH50 #Bett2025
January 22, 2025 at 1:06 PM
Are you coming to Bett? Meet me at the #NetSupportSelfie stop. NetSupport stand SH50 #Bett2025
2024-12-17 (Tues): #SmartApeSG injected script leads to fake browser update page that leads to #NetSupport #RAT infection. A #pcap of the infection traffic, associated malware samples and more information is available at www.malware-traffic-analysis.net/2024/12/17/i...
#FakeUpdates #NetSupportRAT
#FakeUpdates #NetSupportRAT
![Traffic from an infection filtered in Wireshark showing the NetSupport RAT post-infection traffic to 194.180.191[.]64 over TCP port 443](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:v3kgm6hujff4gbxies5vwbnb/bafkreidlaoxf3jfflplxxuiqbtbefkshpgh6c5d5jyn5mfax43f77achvy)
December 17, 2024 at 4:57 AM
2024-12-17 (Tues): #SmartApeSG injected script leads to fake browser update page that leads to #NetSupport #RAT infection. A #pcap of the infection traffic, associated malware samples and more information is available at www.malware-traffic-analysis.net/2024/12/17/i...
#FakeUpdates #NetSupportRAT
#FakeUpdates #NetSupportRAT
An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid
discourse.ifin.netwo...
#ThreatIntel #ThreatIntelligence #IFIN
discourse.ifin.netwo...
#ThreatIntel #ThreatIntelligence #IFIN
Compromised Website Hosting ClickFix Payload Leads to NetSupport RAT Infection
Last Updated: 7/1/2026 What’s Happening A recent trending post by a Mastodon user caught my attention since I actively track ClickFix campaigns: BLUF: The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for...
discourse.ifin.network
July 1, 2026 at 4:14 PM
An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid
discourse.ifin.netwo...
#ThreatIntel #ThreatIntelligence #IFIN
discourse.ifin.netwo...
#ThreatIntel #ThreatIntelligence #IFIN
2024-12-11 (Wednesday): Zip archive containing #NetSupport #RAT hosted at hxxps[:]//homeservicephiladelphia[.]info/work/yyy.zip
C2 for this NetSupport package is 194.180.191[.]64, which is a known NetSupport C2 active since 2024-11-22, per ThreatFox: threatfox.abuse.ch/ioc/1346763/
#NetSupportRAT
C2 for this NetSupport package is 194.180.191[.]64, which is a known NetSupport C2 active since 2024-11-22, per ThreatFox: threatfox.abuse.ch/ioc/1346763/
#NetSupportRAT
December 11, 2024 at 6:39 PM
2024-12-11 (Wednesday): Zip archive containing #NetSupport #RAT hosted at hxxps[:]//homeservicephiladelphia[.]info/work/yyy.zip
C2 for this NetSupport package is 194.180.191[.]64, which is a known NetSupport C2 active since 2024-11-22, per ThreatFox: threatfox.abuse.ch/ioc/1346763/
#NetSupportRAT
C2 for this NetSupport package is 194.180.191[.]64, which is a known NetSupport C2 active since 2024-11-22, per ThreatFox: threatfox.abuse.ch/ioc/1346763/
#NetSupportRAT
You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01...
CODE WHITE | Unauthenticated RCE in NetSupport Manager - A Technical Deep Dive
NetSupport Manager is a remote control and support software that we find surprisingly often utilized in sensitive *Operational Technology (OT)* environments, such as production plant networks. Besides...
code-white.com
January 23, 2026 at 12:28 PM
You like technical deep dives into binary exploitation and crazy heap wizardry? Then you'll like our blog post about unauth'ed RCE in NetSupport Manager aka CVE-2025-34164 & CVE-2025-34165 code-white.com/blog/2026-01...
ISC Diary: Unidentified RAT pushes NetSupport RAT https://isc.sans.edu/diary/33034
June 1, 2026 at 12:06 AM
ISC Diary: Unidentified RAT pushes NetSupport RAT https://isc.sans.edu/diary/33034
Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan reconbee.com/bloody-wolf-...
#bloodywolf #java #Netsupport #RAT #Kyrgyzstan #uzbekistan #cyberattack #cybersecurity
#bloodywolf #java #Netsupport #RAT #Kyrgyzstan #uzbekistan #cyberattack #cybersecurity
Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan
low operating profile thanks read more about Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan
reconbee.com
November 28, 2025 at 12:15 PM
Bloody Wolf Expands Java-based NetSupport RAT Attacks in Kyrgyzstan and Uzbekistan reconbee.com/bloody-wolf-...
#bloodywolf #java #Netsupport #RAT #Kyrgyzstan #uzbekistan #cyberattack #cybersecurity
#bloodywolf #java #Netsupport #RAT #Kyrgyzstan #uzbekistan #cyberattack #cybersecurity
Fake DocuSign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack
Fake DocuSign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack
thehackernews.com
June 3, 2025 at 4:34 PM
Fake DocuSign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack
Party bus is en-route to London baby! #BettUK2026 @netsupport.bsky.social
January 20, 2026 at 3:28 PM
Party bus is en-route to London baby! #BettUK2026 @netsupport.bsky.social
#KRITIS Sektor #Transport und #Verkehr
#Transportation Companies Hit by Cyberattacks Using Lumma Stealer and NetSupport #Malware
"Transportation and #logistics companies in North America are the target of a new phishing campaign that..."
thehackernews.com/2024/09/tran...
#Transportation Companies Hit by Cyberattacks Using Lumma Stealer and NetSupport #Malware
"Transportation and #logistics companies in North America are the target of a new phishing campaign that..."
thehackernews.com/2024/09/tran...
Transportation Companies Hit by Cyberattacks Using Lumma Stealer and NetSupport Malware
North American transport firms targeted by a phishing campaign delivering info stealers and remote access trojans.
thehackernews.com
September 28, 2024 at 9:55 PM
#KRITIS Sektor #Transport und #Verkehr
#Transportation Companies Hit by Cyberattacks Using Lumma Stealer and NetSupport #Malware
"Transportation and #logistics companies in North America are the target of a new phishing campaign that..."
thehackernews.com/2024/09/tran...
#Transportation Companies Hit by Cyberattacks Using Lumma Stealer and NetSupport #Malware
"Transportation and #logistics companies in North America are the target of a new phishing campaign that..."
thehackernews.com/2024/09/tran...
2024-12-13 (Friday): www.anceltech[.]com compromised with #SmartApeSG leading to #NetSupport #RAT 2 injected scripts. jitcom[.]info and best-net[.]biz.
Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best...
#NetSupportRAT
Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best...
#NetSupportRAT
December 13, 2024 at 6:56 PM
2024-12-13 (Friday): www.anceltech[.]com compromised with #SmartApeSG leading to #NetSupport #RAT 2 injected scripts. jitcom[.]info and best-net[.]biz.
Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best...
#NetSupportRAT
Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best...
#NetSupportRAT
Detect malicious activity linked to the FIN7-affiliated GrayAlpha group, which employs diverse infection vectors to deploy PowerNet Loader, NetSupport RAT, and MaskBat Loader using a set of Sigma rules in the SOC Prime Platform.
socprime.com/blog/detect-...
#cybersecurity #detectionengineering
socprime.com/blog/detect-...
#cybersecurity #detectionengineering
GrayAlpha Operation Detection: The Fin7-Affiliated Group Spreads PowerNet Loader, NetSupport RAT, and MaskBat Loader | SOC Prime
Detect GrayAlpha operation spreading PowerNet Loader, NetSupport RAT and MaskBat Loader with Sigma rules from SOC Prime Platform.
socprime.com
June 17, 2025 at 12:06 PM
Detect malicious activity linked to the FIN7-affiliated GrayAlpha group, which employs diverse infection vectors to deploy PowerNet Loader, NetSupport RAT, and MaskBat Loader using a set of Sigma rules in the SOC Prime Platform.
socprime.com/blog/detect-...
#cybersecurity #detectionengineering
socprime.com/blog/detect-...
#cybersecurity #detectionengineering
🚨 IOC Alert: NetSupport Manager RAT Payload Delivery – wood-simple[.]com/drip.sym
darkwebinformer.com/ioc-alert-ne...
darkwebinformer.com/ioc-alert-ne...
IOC Alert: NetSupport Manager RAT Payload Delivery – wood-simple[.]com/drip.sym
IOC Alert: NetSupport Manager RAT Payload Delivery – wood-simple[.]com/drip.sym
darkwebinformer.com
September 2, 2025 at 3:31 PM
🚨 IOC Alert: NetSupport Manager RAT Payload Delivery – wood-simple[.]com/drip.sym
darkwebinformer.com/ioc-alert-ne...
darkwebinformer.com/ioc-alert-ne...
Operation PhantomBlu utilizes a clever trick to deliver the NetSupport RAT by exploiting #Microsoft Office's OLE template manipulation, evading traditional detection methods.
thehackernews.com/2024/03/new-...
#cybersecurity #malware #hacking
thehackernews.com/2024/03/new-...
#cybersecurity #malware #hacking
New Phishing Attack Uses Clever Microsoft Office Trick to Deploy NetSupport RAT
New phishing attacks target US organizations. Hackers use NetSupport RAT to steal data & control computers.
thehackernews.com
March 19, 2024 at 10:11 PM
Operation PhantomBlu utilizes a clever trick to deliver the NetSupport RAT by exploiting #Microsoft Office's OLE template manipulation, evading traditional detection methods.
thehackernews.com/2024/03/new-...
#cybersecurity #malware #hacking
thehackernews.com/2024/03/new-...
#cybersecurity #malware #hacking
2025-03-26 (Wednesday): #SmartApeSG traffic for a fake browser update leads to #NetSupport #RAT and #StealC infection.
A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...
A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...
March 26, 2025 at 8:01 PM
2025-03-26 (Wednesday): #SmartApeSG traffic for a fake browser update leads to #NetSupport #RAT and #StealC infection.
A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...
A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...
2025-06-27 (Friday): #SmartApeSG script for #ClickFix page leads to #NetSupport #RAT
Details at: github.com/malware-traf...
#NetSupportRAT #ClipboardHijacking
Details at: github.com/malware-traf...
#NetSupportRAT #ClipboardHijacking
June 27, 2025 at 7:13 PM
2025-06-27 (Friday): #SmartApeSG script for #ClickFix page leads to #NetSupport #RAT
Details at: github.com/malware-traf...
#NetSupportRAT #ClipboardHijacking
Details at: github.com/malware-traf...
#NetSupportRAT #ClipboardHijacking
2025-08-20 (Wed): #SmartApeSG for fake #CAPTCHA page with #ClickFix instructions that led to an MSI file for #NetSupport #RAT and the #NetSupportRAT infection led to #StealCv2. Malware samples, a #pcap, and indicators at www.malware-traffic-analysis.net/2025/08/20/i...
August 20, 2025 at 11:21 PM
2025-08-20 (Wed): #SmartApeSG for fake #CAPTCHA page with #ClickFix instructions that led to an MSI file for #NetSupport #RAT and the #NetSupportRAT infection led to #StealCv2. Malware samples, a #pcap, and indicators at www.malware-traffic-analysis.net/2025/08/20/i...
Calling all #EduSuperheroes! 📢 New mugs are hot off the press. ☕ @netsupport.bsky.social @alkingsley.bsky.social #Bett2026 #NetSupport SH50
January 21, 2026 at 9:37 AM
Calling all #EduSuperheroes! 📢 New mugs are hot off the press. ☕ @netsupport.bsky.social @alkingsley.bsky.social #Bett2026 #NetSupport SH50
Thanks so much @theanme.bsky.social for these amazing brownies 😍❤️ @netsupport.bsky.social
February 12, 2025 at 12:33 PM
Thanks so much @theanme.bsky.social for these amazing brownies 😍❤️ @netsupport.bsky.social
Loved recording this episode of Insights with @theaveragearday.bsky.social! ❤️Listen to learn how to close gaps in the computing curriculum, what essential skills we should be teaching and how to encourage more students to take an interest in computing. buff.ly/zbfHrtE #Computing #FutureSkills #Tech
June 6, 2025 at 2:54 PM
Loved recording this episode of Insights with @theaveragearday.bsky.social! ❤️Listen to learn how to close gaps in the computing curriculum, what essential skills we should be teaching and how to encourage more students to take an interest in computing. buff.ly/zbfHrtE #Computing #FutureSkills #Tech