NetSupport RAT hits freight carriers from servers shared with a mass-mail panel
A crew is installing the NetSupport Manager remote access tool through VBS scripts whose decoys imitate freight rate confirmations and contracts of carriage. One of the crew's delivery servers sits in a MivoCloud /24 that also hosts FlyMail, a Russian-language email and Telegram outreach platform built to be resold as a service. Matching domain purchases, a shared NetSupport server and a shared…
NetSupport RAT infiltrates freight carriers through servers shared with a mass-mail panel. Malware installers disguised as freight rate confirmations and contracts of carriage infiltrate delivery servers. MivoCloud and Kyonix servers host the malicious software. The servers share a DNS name and domain purchases, linking the operations together.
Snoopy Triage decoded the chain and mapped the servers. The MivoCloud delivery server returned on November 3 under a new domain with the same NetSupport package before going offline again. The Kyonix delivery server remains online, serving the kit from docsforsend.com. Both command-and-control servers accept connections on port 443.
The FlyMail login on 194.180.191[.]209 is no longer accessible. The infection chain begins with a VBS script posing as a Microsoft Edge WebView2 Runtime Compatibility Check. The script decodes the second stage using a custom base64 alphabet and deletes itself after execution. Another VBS downloader stores its configuration in a process environment variable and downloads a fake jQuery file from a malicious domain. stage2.js, a fake jQuery version, reports progress to a tracking server and downloads additional malicious files.
The NetSupport client runs disguised as a legitimate Microsoft Edge WebView2 client. Both delivery servers serve a decoy US freight rate confirmation PDF. The servers run Apache on Debian, with both serving kits from open directories. The servers use common licensees in their configuration files, indicating the malicious software is widely distributed.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
