NightshadeC2: A New Botnet Is Using “UAC Prompt Bombing” to Bypass Windows Defender

NightshadeC2 is a newly identified botnet family identified by the eSentire Threat Response Unit (TRU) and deployed via a loader that combines social engineering, Windows Defender exclusions, and evasion tactics, with a particular focus on “UAC Prompt Bombing” to force user compliance and bypass malware analysis sandboxes.

According to TRU, NightshadeC2 is delivered through a loader that bypasses malware analysis sandboxes and excludes the final payload in Windows Defender using the technique referred to as UAC Prompt Bombing, and infections have been observed spreading via trojanized versions of legitimate software such as Advanced IP Scanner, Express VPN, HyperSecure VPN, CCleaner, and Everything.

The second-stage PowerShell script decrypts a .NET loader that attempts to add a Defender exclusion for the final payload before it touches disk; if the PowerShell command fails, the loader loops, generating a barrage of UAC prompts the victim must accept to regain usability.

The C variant communicates over TCP ports 7777, 33336, 33337 and 443, while the Python variant uses port 80, and its features include reverse shell, download and execute, screen capture, hidden browser launching, keyboard and clipboard capture, and credential theft from Chromium and Gecko-based browsers.

TRU notes two additional UAC bypass methods beyond the prompt bombing, including a 2019 RPC server abuse technique and a loader-based bypass targeting OS versions older than Windows 11 to launch LOLBin processes for elevation and Defender exclusions. Organizations are urged to monitor for suspicious UAC prompts, Defender exclusion changes, and trojanised software sources as part of vigilance against NightshadeC2.