eSentire Details TAG-150’s ClickFix Chain Delivering DinDoor, DenoRAT and NightshadeC2

Jul 15, 2026 · Original article ↗

Summary

eSentire describes a TAG-150 infection at a finance customer, tracing a ClickFix command through DinDoor and DenoRAT to NightshadeC2, and reports that its analysts isolated the affected host.

Key points

The June 2026 incident began with a ClickFix lure prompting a Windows Run command that downloaded and executed an MSI installer.
A likely AI-generated PowerShell stage installed the Deno runtime and launched DinDoor, followed by DenoRAT.
DenoRAT established persistence, registered the host with its C2, and supported remote commands, file operations, screenshots, VNC-style control, and credential and wallet theft.
DenoRAT fetched a Python-based loader that decrypted and reflectively executed NightshadeC2 in memory.
DenoRAT also contains code for Chromium process injection and App-Bound Encryption bypass, though eSentire did not observe that behavior in this incident.
eSentire isolated the affected host and said it was developing detection content; it recommends disabling the Run prompt and using endpoint security tools.

Article Details

Attack Vectors: A ClickFix-style social engineering lure persuaded a user to execute a malicious command through the Windows Run prompt, initiating an MSI-based infection chain.
The MSI wrote and executed Griffin20.ps1, a likely AI-generated PowerShell stage that installed or located the Deno runtime and retrieved DinDoor.
DinDoor retrieved a stager that established registry persistence, registered the infected host with the C2, and fetched DenoRAT.
An observed DenoRAT C2 task executed PowerShell that downloaded a Python-based loader and an encrypted payload, leading to reflective execution of the final payload inside the Python process.
Defensive Notes: The response team isolated the affected host to contain the infection and assisted the customer with remediation.
Disable the Windows Run prompt through Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > enable "Remove Run menu from Start Menu".
Provide phishing and security awareness training using real-world scenarios.
Use a 24/7 multi-signal MDR provider for visibility, threat hunting, disruption, and rapid response; the article recommends NGAV or EDR as a minimum.
The browser DLL-injection capability was present in the malware but was not observed in this incident.
The malware skips browser DLL injection when ESET is detected. The researchers suggest this may reflect attacker testing against security products, rather than demonstrating confirmed detection effectiveness.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`columbnezhjdq[.]com`	ClickFix domain listed in the attack-chain IOC table.
DOMAIN	`smallsmokik[.]com`	NightshadeC2 C2 server identified as a dead-drop in the IOC table.
DOMAIN	`webstizkgao[.]com`	C2 server used by DinDoor, the DenoRAT stager, and DenoRAT.
SHA256	`1f233db3e59051811e16c65e32121f69dd80e91567002978e47a613a5a4903b0`	PowerShell task code that downloads and executes the install.pyc loader.
SHA256	`3dffe05d9cc49b2598d743301a8991965056d97bb8d429de461ed66c0dbde28b`	Analyzed DenoRAT payload.
SHA256	`4ac3e1ecd2c4745f2e846ec7655b92234ee92068bffc7690c3f0184dc25c71da`	Griffin20.ps1 PowerShell stage that installs or locates Deno and launches DinDoor.
SHA256	`6103228087aaee53f37db88ab7aa1e7e5dd8c27a395bef7e3af985774a888c94`	C2 exec-ps task contents containing PowerShell used to decrypt and execute NightshadeC2.
SHA256	`7682e9ac86ff47cc198812719ca54e169c3cb21ce584ad2a278a640f4833de46`	DenoRAT stager responsible for persistence, host registration, and fetching DenoRAT.
SHA256	`a06d514a34d2ab08c3a13a58056827c50ba9bf01b68ca4b2cecb4e1462af53fa`	Second-stage Python script responsible for decrypting and executing NightshadeC2 in memory.
SHA256	`b4fd836b82f2d8daf8b90a95046987e993e5687707fc57b527a8145d865e3fdc`	Encrypted NightshadeC2 payload decrypted and executed by the Python loader.
SHA256	`c1e0a0543b12c64726f8bb36389010d7f35e57993a22ce5b73c56b9cc2a87a00`	NightshadeC2 payload reflectively mapped into the Python process.
SHA256	`c2cdf1ecd6684bbcef0405444a570a76e9589bbd563476b08788bde34d83b511`	Decompiled Python stager that decrypts and executes the next loader stage.
SHA256	`e0dd60bb3a409029988db6a10cb1e36586c2636da9eff3a3587bc38473fde54b`	Compiled install.pyc stager retrieved through DenoRAT tasking to load NightshadeC2.
SHA256	`ece42baaca7524460cc5ffc9ae94c2a634a67610decdd2bdc8f134c36fa2dd6c`	DinDoor launcher that retrieves and evaluates the next-stage stager.
SHA256	`fa0d1adb545881a2d8a508191961a9fd39485c4ac2a0f20ad8e2f931dc45c9ef`	Reflective PE loader shellcode executed by the Python loader.
URL	`hxxp[:]//webstizkgao[.]com`	C2 proxy URL embedded in the hard-coded authorization tokens used by the stager and DenoRAT.
URL	`hxxp[:]//webstizkgao[.]com/health`	C2 health-check endpoint.
URL	`hxxp[:]//webstizkgao[.]com/message-event`	DenoRAT C2 endpoint for receiving tasks and exfiltrating information.
URL	`hxxp[:]//webstizkgao[.]com/user`	C2 endpoint used to register infected devices.
URL	`hxxps[:]//cktdpnuwztdn[.]columbnezhjdq[.]com`	URL in the malicious ClickFix command that initiated the MSI-based infection chain.