NetSupportManager RAT
Aliases: NetSupport
- Malware type
- rat
- Family
- Malware family
- Related IoCs
- 463 (308 malicious)
- Last IoC activity
- 2026-10-18 03:43:52
- Profile updated
- 2026-07-07 13:12:17
Context
Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT.
Detection coverage
- 2 YARA rules
Used by threat actors
- April 2024 FIN7 Malvertising Campaign (campaign)
Detection rules
- CAPE_Netsupport (yara-rule)
- SEKOIA_Loader_Win_Red0044_Powershell_May24 (yara-rule)
Reports & references
- rapid7.com — Ongoing Social Engineering Campaign Linked To Black Basta Ransomware Operators (report)
- rewterz.com — Rewterz Threat Alert Widely Abused Msix App Installer Disabled By Microsoft Active Iocs (report)
- proofpoint.com — Clipboard Compromise Powershell Self Pwn (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- elastic.co — Ghostpulse Haunts Victims Using Defense Evasion Bag O Tricks (report)
- resource.redcanary.com — 2025Threatdetectionreport Redcanary (report)
- blog.prevailion.com — The Curious Case Of Criminal Curriculum (report)
- esentire.com — Fake Chrome Setup Leads To Netsupportmanager Rat And Mars Stealer (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Netsupportmanager Rat (report)
- ptsecurity.com — Operation Ta505 Part2 (report)
- bleepingcomputer.com — Hacked Steam Accounts Spreading Remote Access Trojan (report)
- Trend Micro — New Opcjacker Malware Distributed Via Fake Vpn Malvertising (report)
- medium.com — Netsupport Rat Hits Again With New Iocs 37318De44Cfc (report)
- trellix.com — New Techniques Of Fake Browser Updates (report)
- bleepingcomputer.com — Malicious Web Redirect Service Infects 16 500 Sites To Push Malware (report)
- Kaspersky — 114740 (report)
- blogs.vmware.com — Netsupport Rat The Rat King Returns (report)
- youtube.com — Watch (report)
- netsupportmanager.com — Index (report)
- perception-point.io — Operation Phantomblu New And Evasive Method Delivers Netsupport Rat (report)
- embeeresearch.io — Advanced Cyberchef Operations Netsupport (report)
- researchcenter.paloaltonetworks.com — Unit42 Hoeflertext Popups Targeting Google Chrome Users Now Pushing Rat Malware (report)
- asec.ahnlab.com — 45312 (report)
- embee-research.ghost.io — Advanced Cyberchef Operations Netsupport (report)
- decoded.avast.io — Parrot Tds Takes Over Web Servers And Threatens Millions (report)