GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT
By Insikt GroupⓇ
Excerpt
Insikt Group identified three
GrayAlpha infection vectors: fake
browser updates, fake 7-Zip sites,
and the use of the TDS TAG-124
network, which had not been publicly
linked to GrayAlpha until now.
Insikt Group discovered
PowerNet, a new PowerShell
loader, and MaskBat, an
obfuscated FakeBat variant
with GrayAlpha links; both of
them deliver NetSupport RAT.
CYBER THREAT ANAL…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Recorded Future on go.recordedfuture.com.
Mentioned in the excerpt
More from Recorded Future21
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future · Added 23 Sep
- Latin America and the Caribbean Cybercrime LandscapeRecorded Future · Added 4 Jun
- GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain AttackRecorded Future · Added 17 Apr
- DRAT V2: Updated DRAT Emerges in TAG-140’s ArsenalRecorded Future · Added 17 Aug 2025
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
