Excerpt
Executive Summary
Insikt Group has been monitoring GrayCharlie, a threat actor overlapping with SmartApeSG and active since mid-2023, for some time, and is now publishing its first report on the group. GrayCharlie compromises WordPress sites and injects them with links to externally hosted JavaScript that redirects visitors to NetSupport RAT payloads
delivered via fake browser update pages or ClickFix mechanisms. These infections often progress to the
deployment of Stealc and SectopRAT. Insikt Group identified a large amount of infrastructure linked to
GrayCharlie, primarily tied to MivoCloud and HZ Hosting Ltd. This includes NetSupport RAT command-and-control (C2…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Recorded Future on recordedfuture.com.
Mentioned in the excerpt
More from Recorded Future21
- BlueDelta Targets Defense and Diplomacy with HOOKEDGERecorded Future · Added 23 Sep
- Latin America and the Caribbean Cybercrime LandscapeRecorded Future · Added 4 Jun
- DRAT V2: Updated DRAT Emerges in TAG-140’s ArsenalRecorded Future · Added 17 Aug 2025
- Anatomy of DDoSia: NoName057(16)'s DDoS Infrastructure and TargetingRecorded Future · Added 25 Jul 2025
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Attackers Target Agents via The Skill Supply Chainzenity.io · Published 6 Aug
