LevelBluePDF
CNCMahineRMS
Excerpt
CNCMachineRMS
The undocumented RAT at the end of a BabaDeda chain
A NA LY S I S B Y Rodel Mendrez
DA TE July 30, 2026
CNCMachineRMS: the undocumented RAT at the end of a BabaDeda chain
Overview
A ClickFix lure. A legitimately signed IBM SPSS IDE. Four side-loaded DLLs. A date formatting API used as a trampoline. And at the end of it all, a 1.14 MB implant that calls itself Most writeups of a BabaDeda intrusion stop at the loader and conclude with a line about the framework "delivering infostealers and RATs." This analysis is about what actually came down the chain: a full remote administration platform that is also a second stage loader, which we are tracking as CNCMachineRMS.
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by LevelBlue on levelblue.com.
Mentioned in the excerpt
More from LevelBlue4
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
- Scattered LAPSUS$ Hunters: Anatomy of a Federated Cybercriminal BrandLevelBlue · Published 4 Nov 2025
- SpiderLabs IDs New Banking Trojan Distributed Through WhatsAppLevelBlue · Published 19 Nov 2025
- LevelBlue Labs Discovers Highly Evasive, New Loader Targeting Chinese OrganizationsLevelBlue · Published 19 Jun 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
