ClickFix Attack Spreads Potemkin, RMMProject and EtherRAT Across 11 Hosts

Jun 16, 2026 · Original article ↗

Summary

A ClickFix infection on an unmonitored endpoint led to Potemkin and RMMProject deployment, EtherRAT persistence and hands-on lateral movement across more than 11 hosts. Huntress says monitoring began after the intrusion was underway.

Key points

A user was tricked into running a command that fetched an HTA payload and silently installed an MSI containing the Potemkin loader.
Potemkin used a deterministic DGA and reflective loading to deliver RMMProject, a Lua-scriptable RAT with browser credential theft, remote control and module-loading capabilities.
RMMProject bypassed Chrome App-Bound Encryption by injecting a helper DLL into a spawned browser process to recover keys for credential and cookie theft.
The attackers deployed EtherRAT, which resolves its command-and-control address through the Ethereum blockchain, and used a Cloudflare tunnel for remote access.
The operator attempted to disable Windows Defender, used Chisel tunnels and reverse shells, and moved laterally with WMIExec and SMBExec across more than 11 hosts.
Huntress reports its agent was installed after the intrusion was underway; the SOC then contained the systems and began remediation. The article recommends monitoring all endpoints and alerting on cloudflared executions.

Article Details

Attack Vectors: A compromised website presented ClickFix instructions that induced a user to paste a command into the Windows Run dialog.
The pasted command proxied remote HTA execution through legitimate Windows utilities, leading to a silently installed MSI and an in-memory follow-on implant.
Compromised domain credentials enabled remote execution through WMI, WinRM, and SMB, including access to the domain controller.
The operator distributed an MSI from an attacker-controlled administrative share during bulk lateral movement. Researchers could not retrieve that MSI, so its exact internal execution chain remains unconfirmed.
Run keys, scheduled tasks, reconnecting reverse shells, reverse SOCKS tunnels, and an externally accessible tunnel provided persistence and remote access.
Defensive Notes: Audit endpoint-agent coverage across workstations, servers, and other network-connected machines; the initial unmonitored endpoint allowed substantial activity before visibility became available.
The article recommends disabling the Windows Run dialog and Win+R through Group Policy to interrupt the observed initial execution path.
Enable tamper protection where available and alert on security-service stops, service-disable commands, antivirus policy overrides, and exclusion-path additions.
Alert on tunnel-client execution, including copies renamed to resemble Windows processes.
For the observed JavaScript loader, terminate the Node processes, delete all three loader artifacts, and remove the persistence Run key; removing the key alone is insufficient because the loader rewrites it on startup.
Sweep every affected host and user context for persistence because installation directories, payload filenames, and Run-key values vary.
The loader's fixed-seed domain-generation sequence is finite and precomputable, allowing candidate-domain blocklisting.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`anus-staylard[.]xyz`	Live Potemkin C2 observed in a packet capture and listed as C2 for Potemkin and RMMProject.
DOMAIN	`cl[.]distritovagas[.]com`	ClickFix HTA delivery domain listed in the article's IOC table.
DOMAIN	`fair-bath-fond[.]xyz`	Potemkin DGA candidate observed in the captured infection; registration or live C2 status is not established.
DOMAIN	`pestrear-lamp[.]xyz`	Potemkin DGA candidate observed in the captured infection; registration or live C2 status is not established.
DOMAIN	`resumeacceptable[.]com`	EtherRAT C2 domain resolved through the Ethereum blockchain.
DOMAIN	`rule-bead-dust[.]xyz`	Potemkin DGA candidate observed in the captured infection; registration or live C2 status is not established.
DOMAIN	`sonra[.]eutialyson[.]com`	Attacker-controlled domain distributing the Potemkin MSI.
DOMAIN	`uglyshop-mare[.]xyz`	Potemkin DGA candidate observed in the captured infection; registration or live C2 status is not established.
IPV4	`213[.]165[.]41[.]26`	Attacker Chisel reverse SOCKS server contacted on port 22603.
IPV4	`77[.]110[.]122[.]58`	Attacker C2 and staging server hosting payloads, reverse-shell listeners, a Chisel endpoint, and an MSI administrative share.
SHA256	`2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b`	RunSearch.exe Potemkin loader hash.
SHA256	`2ada24dd6e517f37942b749c2bd57ddd97445e9853002cee70a0bc30d0b0ce3a`	cons_1.0.1.msi installer identified as delivering EtherRAT.
SHA256	`3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce`	RMMProject DLL served as avast_update.bin by the C2.
SHA256	`79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b`	inst24.msi installer that drops Potemkin.
SHA256	`cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145`	Embedded RMMProject helper DLL injected into a browser to recover App-Bound Encryption keys.
URL	`hxxp[:]//77[.]110[.]122[.]58:23205/cons_1[.]0[.]1[.]msi`	EtherRAT installer retrieved through scheduled-task and hands-on execution.
URL	`hxxp[:]//77[.]110[.]122[.]58:23205/lQhEQui9a4lZ[.]exe`	Attacker-hosted Chisel client downloaded repeatedly during attempts to evade Defender.
URL	`hxxp[:]//77[.]110[.]122[.]58:44479/bjxxUmG8K3uy[.]ps1`	Attacker-hosted PowerShell script retrieved and executed for second-wave activity.
URL	`hxxps[:]//cl[.]distritovagas[.]com/hte[.]hta`	Remote HTA payload executed by the initial ClickFix command.
URL	`hxxps[:]//resumeacceptable[.]com`	Live EtherRAT C2 URL returned by its Ethereum contract at analysis time.