NetSupport RAT Campaign Abuses ClickFix to Infect Hosts; 3 Threat Clusters Use RMM for Covert Access

According to eSentire Threat Response Unit (TRU), a major wave of NetSupport RAT campaigns abuses the ClickFix social engineering technique to deliver the remote administration tool and establish three distinct clusters for covert access and data theft. The campaigns deploy PowerShell loaders and, in some cases, MSI-based loaders, with GoLang-based HTTP requests and a Windows Run prompt lure to trigger execution of NetSupport on the target.

TRU describes three clusters: EVALUSION, the most active and widespread with infrastructure spread across multiple countries including the UK; FSHGDREE32/SGI, sharing some technical overlaps with EVALUSION and hosting licenses issued in 2015 and 2017; and XMLCTL, which uses MSI loaders and US-based infrastructure with a different configuration and ports.

The analysis notes that NetSupport infections often blend with normal IT operations, employ persistence mechanisms such as Startup folder shortcuts, and can erase traces by deleting RunMRU registry entries. The campaigns use NetSupport Connectivity Servers (Gateways) version 1.92, with initial poll traffic and C2 communication that leverage a GoHTTP user agent and IEx for remote command execution.