FakeSG enters the ‘FakeUpdates’ arena to deliver NetSupport RAT
Over 5 years ago, we began tracking a new campaign that we called FakeUpdates (also known as SocGholish) that used compromised websites to trick users into running a fake browser update. Instead, victims would end up infecting their computers with the NetSupport RAT, allowing threat actors to gain remote access and deliver additional payloads. As we have seen over the years, SocGholish is an established player that has managed to compromise countless victims and deliver ransomware after facilitating the installation of tools like Cobalt Strike or Mimikatz.
Now, there is a potential new competitor in the “fake updates” landscape that looks strangely familiar. The new campaign, which we call FakeSG, also relies on hacked WordPress websites to display a custom landing page mimicking the victim’s browser. The threat actors are distributing NetSupport RAT either as a zipped download or via an Internet shortcut. While FakeSG appears to be a newcomer, it uses different layers of obfuscation and delivery techniques that make it a threat to take seriously and which could rival potentially rival with SocGholish.
Campaign similarities
We first heard of this new campaign thanks to a Mastodon post by Randy McEoin. The tactics, techniques and procedures (TTPs) are very similar to those of SocGholish and it would be easy to think the two are related. In fact, this chain also leads to NetSupport RAT. However, the template source code is quite different and the payload delivery uses different infrastructure. As a result, we decided to call this variant FakeSG.
Templates
FakeSG has different browser templates depending on which browser the victim is running. The themed “updates” look very professional and are more up to date than its SocGholish counterpart.
Website injections
Compromised websites (WordPress appears to be the top target) are injected with a code snippet that replaces the current webpage with the aforementioned fake updates templates. The source code is loaded from one of several domains impersonating Google (google-analytiks[.]com) or Adobe (updateadobeflash[.]website):
That code contains all the web elements (images, fonts, text) needed to render the fake browser update page. We should note that SocGholish used to retrieve media files from separate web requests until more recently when it started using self-contained Base64 encoded images.
Installation flow
There are different installation flows for this campaign, but we will focus on the one that uses a URL shortcut. The decoy installer (Install%20Updater%20(V104.25.151)-stable.url) is an Internet shortcut downloaded from another compromised WordPress site.
This shorcut uses the WebDav HTTP protocol extension to retrieve the file launcher-upd.hta from a remote server:
This heavily obfuscated script is responsible for the execution of PowerShell that downloads the final malware payload (NetSupport RAT).
Malwarebytes’s EDR shows the full attack chain (please click to enlarge):
The NetSupport RAT files are hosted on the same compromised WordPress site used earlier to download the Internet shortcut. The RAT’s main binary is launched from “C:Users%username%AppDataRoamingBranScaleclient32.exe“.
Following a successful infection, callbacks are made to the RAT’s command and control server at 94.158.247[.]27.
Roomates
Fake browser updates are a very common decoy used by malware authors. In addition to SocGholish, the Domen toolkit was a well-built framework that emerged in 2019 while another campaign known as sczriptzzbn dropped SolarMarker leading to the NetSupport RAT in both cases. Initial access brokers use tools like NetSupport RAT to gather information and perform additional actions on victims of interest. Stolen credentials can be resold to other threat actors tied to ransomware gangs.
It is interesting to see another contender in this relatively small space. While there is a very large number of vulnerable websites, we already see some that have been injected with multiple different malicious code. From a visitor’s point of view, this means there could be more than one redirect but the “winner” will be the one who is able to execute their malicious JavaScript code first.
We will continue to monitor these campaigns and in particular SocGholish to see if the web delivery landscape changes. Malwarebytes customers are protected as we detect the infrastructure and final payload used in these attacks.
Indicators of Compromise (IOCs)
FakeSG infrastructure
178.159.37[.]73
google-analytiks[.]com
googletagmanagar[.]com
updateadobeflash[.]website
WebDav launcher
206[.]71[.]148[.]110
206[.]71[.]148[.]110/Downloads/launcher-upd[.]hta
NetSupport RAT
pietrangelo[.]it/wp-content/uploads/2014/04/BranScale[.]zip
pietrangelo[.]it/wp-content/uploads/2014/04/client32[.]exe
NetSupport RAT C2
94[.]158[.]247[.]27
MITRE ATT&CK techniques
| Tactic | ID | Name | Details |
| Execution | T1059 | Command and Scripting Interpreter | Powershell used to download payload |
| T1059.001 | Powershell | Starts POWERSHELL.EXE for commands execution | |
| T1059.003 | Windows Command Shell | Starts CMD.EXE for commands execution | |
| Privilege escalation | T1548 | Abuse Elevation Control Mechanism | Encoded PowerShell |
| T1548.002 | Bypass User Account Control | ||
| Defense evasion | T1564 | Hide Artifacts | Encoded PowerShell |
| T1218 | System Binary Proxy Execution | Drops CMSTP.inf in %temp% | |
| T1027 | Obfuscated Files or Information | Drops th5epzxc.cmdline in %temp% | |
| T1112 | Modify Registry | Adds key to registry: HKEY_CLASSES_ROOTCLSID{645FF040-5081-101B-9F08-00AA002F954E}shellopencommand /f /ve /t REG_SZ /d C:UsersadminAppDataRoamingBranScaleclient32.exe | |
| T1548 | Abuse Elevation Control Mechanism | ||
| T1140 | Deobfuscate/Decode Files or Information | Encoded PowerShell | |
| Discovery | T1082 | System Information Discovery | Gets computer name |
| C&C | T1071 | Application Layer Protocol | NetSupport RAT C2 communication |
| T1571 | Non-Standard Port | Port destination: 5051 |
Malwarebytes EDR and MDR removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.