Threat Actors Abuse NetSupport Manager to Gain Remote Access and Exfiltrate Data

Mar 10, 2026 · Original article ↗

Summary

Darktrace reports NetSupport RAT activity across customer networks, including ClickFix and other delivery methods, remote access and data theft capabilities, and suspicious C2 connections identified through anomalous network behavior.

Key points

Threat actors abuse legitimate NetSupport Manager to gain unauthorized remote access to victim systems.
Delivery methods include ClickFix-style fake CAPTCHA or problem-fix prompts, phishing, fake browser updates, malicious websites, malvertising, and drive-by downloads.
Attackers may install the tool in non-standard directories, then monitor activity, exfiltrate data, maintain persistence, and download additional payloads.
Darktrace observed suspicious activity across customers in the Americas, EMEA, and other regions in November 2025.
In one case, Darktrace detected unusual connections to a rare external endpoint and a previously unseen user agent; investigation linked the endpoint to NetSupport RAT command-and-control.
The article provides associated C2 domains, IP addresses, and a URI as indicators of compromise.
The report says anomaly-based detection can identify suspicious behavior even when known signatures or indicators are absent.

Article Details

Attack Vectors: ClickFix social engineering that tricks users into executing malicious PowerShell commands.
Phishing emails, fake browser updates, malicious websites, SEO poisoning, malvertising, and drive-by downloads that direct users to fraudulent pages or fake reCAPTCHA checks.
Installation of NetSupport Manager on compromised devices, followed by remote access, monitoring, data exfiltration, C2 communication, and persistence.
Additional malicious payloads may be downloaded after NetSupport RAT is installed, according to external research.
Defensive Notes: Darktrace reports detecting anomalous connections to rare external domains and IP addresses, unusual user-agent activity, and HTTP POST requests, including when indicators or signatures were not already known.
Validate anomalous use of legitimate software and remote-management tools; anomaly-based monitoring can identify behavior that deviates from a device’s normal pattern of life.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`finalnovel[.]com`	Listed as a NetSupportRAT C2 endpoint.
HOSTNAME	`heaveydutyl[.]com`	Listed as a NetSupportRAT C2 endpoint.
HOSTNAME	`holonisz[.]com`	Listed as a NetSupportRAT C2 endpoint.
HOSTNAME	`nsgatetest1[.]digital`	Listed as a NetSupportRAT C2 endpoint.
HOSTNAME	`thetavaluemetrics[.]com`	Identified as a NetSupportRAT C2 endpoint.
HOSTNAME	`westford-systems[.]icu`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`104[.]21[.]40[.]75`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`107[.]158[.]128[.]84`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`141[.]98[.]11[.]224`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`185[.]39[.]19[.]233`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`217[.]91[.]235[.]17`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`38[.]146[.]28[.]242`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`45[.]88[.]79[.]237`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`45[.]94[.]47[.]224`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`74[.]91[.]125[.]57`	Identified as a NetSupportRAT C2 endpoint.
IPV4	`87[.]120[.]93[.]98`	Listed as a Rhadamanthys C2 endpoint.
IPV4	`88[.]214[.]27[.]166`	Listed as a NetSupportRAT C2 endpoint.
IPV4	`88[.]214[.]27[.]48`	Listed as a NetSupportRAT C2 endpoint.