BlackCrypt Malware Uses Signed RMM Agent to Hide Phishing Lures

Oct 10, 2026 · Original article ↗

Summary

Sandbox analysis found that BlackCrypt’s signed Windows agent installs as a service, enables remote control and searches for fake DocuSign, Adobe and other installers to hide them. The report identifies blackcryptknight[.]com as a C2 domain.

Key points

A small downloader retrieves a BlackCrypt agent using a six-character code in the downloader’s filename; without the code, it stops.
The agent installs as a Windows service running as LocalSystem, or uses a per-user autostart entry, and supports remote commands, shells and screenshots.
Both programs are EV-signed by C&P Global Investors LLC but branded as BlackCrypt Labs Inc.; the report says both certificates were reported to their issuing CAs.
In a sandbox, the server sent automatic scripts within seconds of enrollment to search for and hide fake DocuSign, Adobe, HSA and payment-document installers.
The lure installers were not recovered, and the analysis did not establish who operates BlackCrypt or what happens after initial onboarding.
The report identifies BlackCryptAgent, related file paths, a mutex and scheduled-task names as defender search leads, and recommends allowing only approved RMM tools.

Article Details

Attack Vectors: A downloader requires a six-character code appended to its filename, queries blackcryptknight[.]com for the corresponding build, downloads the Agent, and runs it.
The article reports that the operator's scripts search user folders for fake DocuSign, Adobe, HSA, and payment-document installers and move matching files to a temporary folder where they are hidden.
The Agent installs as a Windows service running as LocalSystem when elevated, or uses a per-user Run registry entry without admin rights; it maintains a WebSocket connection for remote commands.
The Agent supports PowerShell, cmd, and batch execution, including execution as SYSTEM through a scheduled task, remote terminal sessions, and screenshot capture.
Defensive Notes: Look for the BlackCryptAgent service, the folders C:\Program Files\BlackCrypt Labs\ and C:\ProgramData\BlackCrypt\, the Global\BlackCryptRmmAgentSingleton mutex, processes launched with --session-task, and scheduled tasks named BlackCrypt-System-<id> or BlackCryptSessionTask_<id>.
Alert on executables named *_XXXXXX.exe (six letters or digits) signed by C&P Global Investors LLC, and block the reported C2 domains and IP address.
Use an allow-list for RMM software and investigate any RMM agent not deployed by the IT team.
Advise users not to run installers presented as document readers or updates from unexpected email attachments or download links.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`apinetsolworkspace[.]network`	Domain listed in the article as BlackCrypt C2 infrastructure.
DOMAIN	`blackcryptknight[.]com`	BlackCrypt C2 domain used to resolve downloader build codes and host the operator panel.
DOMAIN	`devicehubcloud[.]com`	Domain listed in the article as BlackCrypt C2 infrastructure.
DOMAIN	`ws[.]blackcryptknight[.]com`	Reported C2 domain used as the Agent's WebSocket host.
IPV4	`89[.]117[.]54[.]201`	Reported WebSocket C2 IP address.
SHA256	`7206a66435b45db34e7772297b192d296e3206bedf0a854f1593717f6545285b`	SHA-256 hash identified in the article as BlackCrypt Agent 4.2.1.36.
SHA256	`971492297864b72dbfbede769f1ea6472ad80d911404636d14d4fa5babdc68c4`	SHA-256 hash identified in the article as the September 2026 BlackCrypt Stub.
SHA256	`bb5c49eaa94615f7d75cfa80afb8e79b12da2defc47d9b9c53d7602e7171b668`	SHA-256 hash identified in the article as BlackCrypt Agent 4.2.1.35.
SHA256	`f58b67e61ee947afd2e9e45f7ecd392d5fedc8f6b29a3d2ec5a323e38aba253c`	SHA-256 hash identified in the article as the new BlackCrypt Stub.