Telemetry Investigation Links SmartApeSG to Active NetSupport RAT Servers
Summary
Team Cymru used internet telemetry to trace SmartApeSG management hosts to active NetSupport RAT servers and observe a connection to a Quasar RAT C2. The relationship between some infrastructure and threat actor activity remains uncertain.
Key points
- SmartApeSG is a FakeUpdate threat that can trick users into installing a fake browser update, often leading to NetSupport RAT deployment.
- Telemetry identified two Moldova-based MivoCloud hosts connecting to SmartApeSG C2 servers over TCP/1500; the researchers suspect they may have been used for C2 management.
- A third MivoCloud host communicated with multiple NetSupport RAT C2 servers, including infrastructure that had been publicly reported earlier and was still receiving victim communications.
- Shared certificate characteristics and observed connections suggest links between the SmartApeSG and NetSupport RAT infrastructure, but do not establish definitive attribution.
- One NetSupport RAT C2 communicated with a Quasar RAT C2 and unusual hosts associated with varied activity; the researchers say the relationship to threat actor operations is unclear.
- Team Cymru reported C2 infrastructure to hosting providers, resulting in takedowns; some NetSupport RAT domains were later pointed to new IPs, and further infrastructure was reported.
Article Details
- Attack Vectors
- SmartApeSG uses fake browser-update lures on compromised websites; victims who install the fake update are typically infected with NetSupport RAT.
- NetSupport RAT is delivered through fake-update campaigns such as SmartApeSG and through phishing, according to the article.
- Defensive Notes
- Review older indicators periodically because previously reported NetSupport RAT infrastructure was still receiving victim communications and some domains later pointed to new IPs.
- Hunt for the reported indicators and the X.509 certificate common names described in the investigation.
- The researchers reported SmartApeSG and NetSupport RAT infrastructure to hosting providers; the article reports that providers took down multiple hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 23mtkro[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | asdgelvasd[.]icu | Listed as a domain IOC in the investigation. |
| DOMAIN | comparegjs[.]com | Listed as a domain IOC in the investigation. |
| DOMAIN | duvje6egvuas[.]com | Listed as a domain IOC in the investigation. |
| DOMAIN | e3ubj753ifg[.]xyz | Listed as a domain IOC in the investigation. |
| DOMAIN | fufvnasie[.]icu | Listed as a domain IOC in the investigation. |
| DOMAIN | gkdkr[.]icu | Listed as a domain IOC in the investigation. |
| DOMAIN | huntaget[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | jintsung[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | mgsubneu4hgba[.]xyz | Listed as a domain IOC in the investigation. |
| DOMAIN | moreeu[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | nfdsnvuusds7d64jg[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | ruhvsvya[.]icu | Listed as a domain IOC in the investigation. |
| DOMAIN | sasfyvuaseyzzs[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | scheduleyaraupd2[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | sdgn446yhd[.]cn | Listed as a domain IOC in the investigation. |
| DOMAIN | sevndgkhkidgr[.]xyz | Listed as a domain IOC in the investigation. |
| DOMAIN | zytjbgev[.]icu | Listed as a domain IOC in the investigation. |
| IPV4 | 185[.]153[.]183[.]59 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 193[.]107[.]109[.]76 | Reported Quasar RAT C2 that communicated with a NetSupport RAT C2. |
| IPV4 | 194[.]31[.]109[.]74 | NetSupport RAT C2 identified by the researchers; it received connections on TCP/2552 and had NetSupport RAT domains pointing to it. |
| IPV4 | 45[.]67[.]35[.]101 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 45[.]8[.]145[.]132 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 5[.]181[.]156[.]16 | Moldovan host likely used to manage SmartApeSG C2 infrastructure; the attribution is presented as a possibility. |
| IPV4 | 5[.]181[.]157[.]69 | Moldovan host likely used to manage SmartApeSG C2 infrastructure; it also connected to a reported NetSupport RAT C2. |
| IPV4 | 5[.]181[.]158[.]15 | MivoCloud host that communicated with NetSupport RAT C2 servers and later with newly identified IPs. |
| IPV4 | 5[.]181[.]159[.]111 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 5[.]181[.]159[.]113 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 5[.]181[.]159[.]119 | Listed as an indicator in the investigation's IOC section, which reports newly identified and provider-reported infrastructure. |
| IPV4 | 95[.]164[.]37[.]152 | Reported NetSupport RAT C2 that was still active in the researchers' telemetry. |
MITRE ATT&CK
T1189 · Drive-by CompromiseSmartApeSG lures users with a fake browser update after they visit a compromised website.T1204.002 · Malicious FileThe campaign relies on victims installing the fake browser update, which typically results in NetSupport RAT deployment.T1219 · Remote Access ToolsThe article describes NetSupport Manager, a legitimate remote administration tool, being maliciously used as NetSupport RAT to control victim systems.
Malware
LycantroxThis C2 also frequently communicated with 193.107.109.76, which was reported to ThreatFox as a Lycantrox C2 in 2023 and later as a Quasar RAT C2 in August 2024, a few weeks after we observed its communication with theNetSupport RATThis investigation began with the analysis of SmartApeSG, a FakeUpdate threat that delivers NetSupport RAT to victims. Initial efforts to track its Command and Control (C2) infrastructure led to unexpected discoveriesQuasar RAT- Quasar RAT Connection: Observed communication between a NetSupport RAT C2 and a Quasar RAT C2, along with several unusual hosts. It is unclear if this activity is directly related to the threat actor'sZPHPThis investigation began with the analysis of SmartApeSG, a FakeUpdate threat that delivers NetSupport RAT to victims. Initial efforts to track its Command and Control (C2) infrastructure led to unexpected discoveries
Vendors
Hivelocitycouple more weeks, procuring new VPS hosts which were also promptly taken down, before transitioning to Hivelocity (HVC-AS) for about a month, and then to HostZealot (HZ-US-AS). Since that time, no additionalHostzealotalso promptly taken down, before transitioning to Hivelocity (HVC-AS) for about a month, and then to HostZealot (HZ-US-AS). Since that time, no additional ISPManager activity has been observed from the two MoldovanMivoCloud- Management Hosts: Identified three Moldovan IPs (assigned to MivoCloud) likely used for C2 management—two tied to SmartApeSG and one to the NetSupport RAT clusterStark Industriesbackend infrastructure or threat actor operations. At the time, the C2 infrastructure was hosted on Stark Industries, however this is no longer the case following takedown action by the hosting provider.
Products
ISPManagerVisiting one of the C2s on port 1500 in a browser revealed an ISPManager login page.NetSupport ManagerNetSupport RAT refers to the malicious use of NetSupport Manager, a legitimate remote administration tool. When abused, it can be used to control systems, steal data, or install malware. It is often delivered through
Countries
Industries
Cryptocurrencyactive NetSupport RAT servers, and cross-connections to suspicious infrastructure, including RATs, cryptocurrency services, and platforms linked to illicit activity.Financial Serviceswhich appeared to impersonate ubs[.]com, the legitimate website of a major investment bank and financial services company.