ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

1. Executive summary

Cisco Talos has documented two related infection chains — tracked under loader names "pf.ch" and "verification.google" — that deliver the Amatera credential and cryptocurrency stealer via a ClearFake/ClickFix social-engineering pattern: JavaScript injected into compromised websites by a malicious Cloudflare Worker, with stage code stored on BNB Smart Chain contracts (EtherHiding), culminating in a fake Google CAPTCHA prompt that instructs the victim to paste a WebDAV UNC path into the Windows Run dialog. The WebDAV-hosted DLL is executed via 32-bit rundll32.exe with ordinal #1 invocation, and the chains deploy distinct secondary payloads: a BYOVD-based EDR-termination package with the ZigCryptoStealer clipboard-hijacking payload and a Go reverse TCP proxy ("pf.ch" branch), and an unauthorised, silently-configured NetSupport Manager remote-access installation ("verification.google" branch). The initial observation was at a Ukrainian government organisation in April 2026; Talos assesses with moderate confidence the activity is an opportunistic cryptocurrency/credential-stealing operation rather than a targeted attack, and attributes the "verification.google" branch to a Russian threat actor with moderate confidence. Attribution to tracked actor "UAT-10820" is unconfirmed — the actor has no MITRE ATT&CK profile in our verified reference data. For EMEA financial services the bottom-line risk is workstation-level credential theft (password managers, authenticators, mail clients, 100+ wallet locations), followed in one branch by persistent operator-controlled remote access — a combination that can convert a commodity stealer infection into hands-on access to banking sessions and internal systems.

2. Regulatory framing

No other article in the regulatory reference is specifically engaged. The third-party/supply-chain articles are not triggered: the delivery vector is compromised public websites and victim-executed commands, not an ICT third-party provider relationship.

3. Technical analysis & attack chain

Confirmed attack chain ("pf.ch" branch, fully reconstructed by Talos)

1. Initial access — ClearFake injection. A malicious Cloudflare Worker injects JavaScript into the content of a compromised website. The injected script queries BNB Smart Chain testnet contract 0x886d310Ac23e05EA705e24E513D19f53793832A9 via bsc-testnet-rpc[.]publicnode[.]com — the actor uses the contract as remotely changeable storage for encoded JavaScript (EtherHiding), with the blockchain acting as bulletproof hosting.
2. Environment checks and stage selection. The JavaScript checks for local and headless browser environments and identifies the OS. Windows victims retrieve code from contract 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff; macOS victims from 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5. Responses are Base64-decoded and evaluated as JavaScript.
3. ClickFix social engineering. The Windows stage creates a victim identifier stored in the cjs_id cookie, queries a tracking contract for goal completion, and — if the browser is not headless and the OS is Windows — overlays a fake Google CAPTCHA-style checkbox instructing the victim to open the Windows Run dialog, paste the clipboard contents, and press Enter.
4. WebDAV execution. The copied command opens a WebDAV path on a randomised subdomain of leaguejazire[.]com, embeds the victim identifier in the path, and executes pf.ch via ordinal #1 through 32-bit rundll32.exe. The Windows WebClient service starts as part of this execution.
5. Loader unpacking. pf.ch is a packed 32-bit DLL whose only named export is moor; its import table contains only AddVectoredExceptionHandler and __mb_cur_max. It uses vectored exception handling, XOR loops, API hashing and control-flow obfuscation. A thread waits on an event named hit; on trigger it copies an embedded blob to memory and transfers control via Windows fibers. A second-stage decoder uses XOR and LZNT1 to decode the final Amatera payload.
6. Amatera payload. A 32-bit PE with no import table that resolves APIs by walking loaded module export tables, and uses 32-to-64-bit transitions to execute system calls (likely to evade EDR hooks). Build label 4.1.5-alpha; contains the string GETWELLV2. The payload was recovered only as a memory-resident artifact and was not observed written to disk.
7. C2 resolution via dead drop. The sample constructs the dead-drop URL hxxps://telegra[.]ph/Functions-04-03 — a Telegraph page disguised as a short Rust programming tutorial titled "Functions." with an altered code example containing r.]MTQ1LjI0OS4xMDkuMTQ3)0(. Base64-decoding MTQ1LjI0OS4xMDkuMTQ3 yields C2 address 145.249.109[.]147.
8. C2 session. Amatera generates WoW64 transition gates, opens an AFD socket, and connects directly to 145.249.109[.]147 on TCP 443. It calls GetEndpoints to obtain randomised URI paths, then retrieves its configuration. Observed traffic framing is consistent with the ECDH and ChaCha20-Poly1305 protocol documented for recent Amatera versions. The configuration is Base64-decoded then XOR-decoded with the key 852149723\x00 before JSON parsing.
9. Secondary payload deployment. The configuration's ld array drives secondary loaders: u = download URL, tf = payload type, tr = file-based (1) or fileless (2) execution, p = task order. Supported types include executables, DLLs, command scripts, PowerShell, raw shellcode and MSI packages.

"verification.google" branch (initial detection, upstream stages not directly recovered)

• Same WebDAV/rundll32/ordinal-#1 pattern; first export is CfgInspectModuleData. Different loader code and protection: it defers unpacking via a work callback registered with the dynamically resolved, undocumented TpAllocWork in ntdll.dll, executed asynchronously. The callback implements unpacking in a large control-flow-flattening loop. The loader resolves functions by hash, derives execution state from the environment, and implements direct WoW64 syscall stubs that decode syscall numbers at runtime and call the WoW64 transition pointer rather than exported ntdll.dll functions.
• Module stomping: it reconstructs its next stage from .rdata data, maps a clean image of legitimate dbghelp.dll in memory, overwrites the beginning of its code section with the unpacked stage, restores executable protection, and transfers control to the overwritten region (DLL hollowing/module overloading).
• C2: this Amatera build stores its bootstrap controller as an encrypted string, decrypts the fixed address 45.150.34[.]2 at runtime, and connects directly on TCP 443 while presenting github[.]com as the TLS server name and HTTP Host value (domain fronting-style masquerade). It does not use a public dead-drop resolver. After GetEndpoints, it retrieves a configuration with over 400 collection entries.
• Talos assesses with low to medium confidence that the two delivery chains are identical upstream.

Data collection scope (both branches, from Amatera configuration): browser data plus Telegram, Signal, WhatsApp and other messaging data; over 100 desktop wallet locations; credentials from password managers, authenticators, FTP clients, mail clients, VPN software and remote-access tools — representative targets include KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN and AzireVPN. Four file-grabber rules cover Desktop, Downloads, Documents and Windows Recent-items, with more than 100 filename/extension patterns targeting private keys, wallet backups, API/OAuth material, 2FA data, password databases and certificate files (.kdbx, .p12, .pfx, .pem). Collection is heavily weighted to cryptocurrency material and credentials.

Secondary payload 1 — ZigCryptoStealer + BYOVD EDR termination ("pf.ch", priority 1, file-based)

• The jquery.min.js task (tf: 1, tr: 1) downloads a ZIP (SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92), extracted to a temp directory; the loader enumerates resulting *.exe files and launches one.
• The archive contains platform_experience_helper.exe, a legitimate signed Google Chrome component that imports GetUserNameExW from Secur32.dll — a malicious DLL in the same archive that gets side-loaded.
• The side-loaded Secur32.dll is a .NET NativeAOT loader that decrypts and loads two PEs. It starts C:\Windows\explorer.exe suspended, manually maps the first PE's headers and sections into the child, changes the initial thread context to the new entry point, and resumes it.
• Payload: ZigCryptoStealer, a cryptocurrency stealer written in Zig. It polls the clipboard, recognises several cryptocurrency address formats, and replaces matching values with attacker addresses embedded in the payload.
• EtherHiding reuse by the payload: ZigCryptoStealer makes a JSON-RPC eth_call via bsc[.]rpc[.]blxrbdn[.]com to BNB Smart Chain contract 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468, disguised as an ERC-20 token-balance query. The contract ignores the supplied address and returns operator-set text; the operator rotates it via setData(string). At analysis time it returned lb[.]propertyfind[.]cc as the C2 domain. The contract was deployed 2026-03-16; the deploying wallet made 39 successful setData calls through 2026-07-26. Historical C2 values (all resolving through shared Cloudflare addresses): fd[.]gstats-api-contact[.]cc (Jun 30–Jul 5), pkg[.]vogueatelier[.]cc (Jul 5–9), kffd3[.]vogueatelier[.]cc (Jul 9–12), kffd3[.]vexlatech[.]cc (Jul 12–18), static[.]quorashift[.]cc (Jul 18–26), lb[.]propertyfind[.]cc (Jul 26–30). Cisco Umbrella observed DNS queries for these domains from up to 98 countries (lb[.]propertyfind[.]cc), most often from the United States, Indonesia, Brazil, India and Egypt — indicating broad, non-targeted victim distribution.
• BYOVD EDR termination: the second decrypted PE is a signed Windows driver with version information naming "MOCOMSYS & DCRC" and "DCRCV_U Driver (for SCM)", original filename DCRCVDrv.sys, exposing device \Device\DCRCVDRV_U. The NativeAOT loader enumerates running processes, hashes their names against an internal target list of EDR/security tools, and sends matched PIDs to the driver via IOCTL 0x2205c0. The driver's handler takes the four-byte PID, obtains a handle and calls ZwTerminateProcess, with no caller authorisation check — a kernel-mode process-termination primitive.

Secondary payload 2 — Go reverse TCP proxy ("pf.ch", fileless shellcode)

• Shellcode blob SHA-256 643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205; walks the PEB to locate ntdll.dll, resolves LdrLoadDll, NtAllocateVirtualMemory, NtProtectVirtualMemory, NtFreeVirtualMemory, then decrypts (XOR) and decompresses (LZNT1) the final payload, SHA-256 1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25.
• A 32-bit Golang Windows executable, main package github.com/acr/proxy-panel/cmd/bot, including HashiCorp Yamux multiplexing, with hardcoded C2 wss://update[.]dubbedmuch[.]cc/. It reads the Windows MachineGuid and hostname and sends them over WSS; after C2 acceptance it creates a Yamux server session multiplexing streams over the single connection. Each stream supplies source and destination addresses; the client connects to the requested destination and relays bytes bidirectionally — turning the host into an attacker-controlled reverse proxy.

Secondary payload 3 — NetSupport Manager installation ("verification.google", fileless PowerShell)

• The ld task points to hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js; tf: 4 identifies PowerShell, tr: 2 selects DownloadString/Invoke-Expression execution.
• The script dynamically resolves native functions, runs environment checks, derives an installation path by hashing MachineGuid|zdozwoqx3c, and starts two background PowerShell runspaces requesting many legitimate URLs (GitHub API, npm, Docker Hub, PyPI, NuGet, PowerShell Gallery) as decoy traffic mimicking developer activity.
• It downloads hxxps://phys[.]stunned-amniotic[.]com/hub[.]log — at analysis time a ZIP, SHA-256 bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b. Note: Talos found no evidence in the Ukrainian victim's logs that this URL was accessed; the file was retrieved by Talos as the likely intended payload — single-sourced reconstruction, verify before enforcement.
• The script validates ZIP entry paths, extracts to %APPDATA%, launches hypersnap.exe without a visible window, and creates a scheduled task triggered at user logon (persistence).
• hypersnap.exe is a renamed, signed NetSupport Manager 12.44 client32.exe, which calls export _NSMClient32@8 in signed PCICL32.DLL (the main NetSupport client runtime).
• The actor-controlled client32.ini enables silent operation, hides the system-tray interface, disables visible chat/message/disconnect/replay/help controls, and configures paternal-angrily[.]com:443 as the NetSupport HTTP Gateway. The client polls the gateway every 60 seconds. At analysis time the domain resolved to 212.118.56[.]166, based in Russia.
• The deployment used license name "KAKAN", serial NSM789508. Talos notes this exact license file has appeared in numerous malicious NetSupport packages, including activity tracked as EVALUSION and IClickFix — treat it as shared deployment lineage, not a unique actor identifier.
• Capability impact: after Amatera's automated collection, NetSupport gives an operator screen and input control, file transfer, inventory, process/service management, and remote command/PowerShell execution — enabling inspection beyond Amatera's predefined rules, use of stolen sessions from the original endpoint, or deployment of additional tooling.

Confidence caveats: Attribution to actor "UAT-10820" is unconfirmed — no MITRE ATT&CK profile exists in our verified reference data. Talos's moderate-confidence assessment that the "verification.google" branch was conducted by a Russian threat actor rests on the Russia-based NetSupport gateway IP and is single-sourced (Talos only). The linkage of the two delivery chains is assessed by Talos at low-to-medium confidence. The Malwarebytes and Blackpoint Cyber Amatera campaigns share no common infrastructure with these chains beyond the payload family. Censys documented the same Windows/macOS blockchain contracts in a different ClickFix chain with different downstream payloads.

4. Mitigation & containment

P1 — within 24 hours

1. Hunt for the WebDAV execution pattern across the estate: 32-bit rundll32.exe (C:\Windows\SysWOW64\rundll32.exe) executing a file from a WebDAV UNC path (\\...\DavWWWRoot\ or http:///https://-backed WebDAV), paired with Windows WebClient (WebClient service) start events. Any hit on this pattern is a high-fidelity compromise signal for this chain.
2. Block the observed network infrastructure at egress/DNS: leaguejazire[.]com and all subdomains, riyazinikokar[.]xyz (macOS branch), 145.249.109[.]147, 45.150.34[.]2, 212.118.56[.]166, paternal-angrily[.]com, update[.]dubbedmuch[.]cc, kr[.]cedar2glanz[.]ru, phys[.]stunned-amniotic[.]com, and the six ZigCryptoStealer C2 domains (fd[.]gstats-api-contact[.]cc, pkg[.]vogueatelier[.]cc, kffd3[.]vogueatelier[.]cc, kffd3[.]vexlatech[.]cc, static[.]quorashift[.]cc, lb[.]propertyfind[.]cc). Note the blockchain-based delivery means stage-one infrastructure is not blocking-friendly — the contracts (0x886d310Ac23e05EA705e24E513D19f53793832A9, 0x46790e2Ac7F3CA5a7D1bfCe312d11E91d23383Ff, 0x68DcE15C1002a2689E19D33A3aE509DD1fEb11A5, 0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468) are only reachable via public RPC endpoints such as bsc-testnet-rpc[.]publicnode[.]com and bsc[.]rpc[.]blxrbdn[.]com; consider whether those endpoints are business-justified on workstations.
3. Disable or restrict the WebClient service on workstations where WebDAV is not a business requirement (sc config WebClient start= disabled); this breaks the execution primitive for the entire chain. Where WebDAV is required, restrict it by GPO to approved servers only.
4. Alert on, and block, the BYOVD driver: DCRCVDrv.sys (device \Device\DCRCVDRV_U, IOCTL 0x2205c0). Add the driver to blocklists if your EDR supports driver blocking; hunt for the device name in kernel telemetry. Any process-termination IOCTL from a user-mode loader to this driver is an EDR-kill attempt in progress.
5. Hunt for unauthorised NetSupport Manager: scheduled tasks at user logon launching hypersnap.exe from %APPDATA%; client32.ini referencing paternal-angrily[.]com; any client32.exe/PCICL32.DLL pair outside approved software channels; license serial NSM789508. If found, treat the host as operator-accessed, not merely malware-infected — isolate and rebuild.

P2 — within 72 hours

1. Hunt clipboard-hijack and proxy persistence: ZigCryptoStealer is memory-resident via explorer.exe injection — check for explorer.exe child processes or injected modules exhibiting clipboard polling; the Go proxy beacons to wss://update[.]dubbedmuch[.]cc/ — hunt for outbound WSS from unusual 32-bit Go binaries and Yamux-protocol traffic.
2. Hunt the decoy-traffic pattern: bursts of background PowerShell runspaces querying GitHub API, npm, Docker Hub, PyPI, NuGet and PowerShell Gallery from the same host in a short window, especially paired with a DownloadString/IEX execution.
3. Hunt the TLS masquerade: outbound TCP 443 to 45.150.34[.]2 with SNI/Host github[.]com — a mismatch between destination IP ownership and presented SNI is the detection signal.
4. Credential-exposure response: for any confirmed Amatera execution, assume compromise of browser data, messaging data (Telegram, Signal, WhatsApp), 100+ wallet locations, and credentials from KeePass, Bitwarden, 1Password, RoboForm, NordPass, WinAuth, Authy, FileZilla, AnyDesk, NordVPN, AzireVPN, plus files matching .kdbx, .p12, .pfx, .pem and 2FA/API/OAuth material in Desktop, Downloads, Documents and Recent-items. Force password-vault and mailbox credential resets, revoke active sessions and tokens, and re-enrol 2FA.
5. User awareness: brief staff on the ClickFix pattern — a browser prompt instructing them to open Run/PowerShell/Terminal and paste clipboard content is never legitimate. This is the sole initial-access gate for the chain; it fails without victim action.

P3 — within 7 days

1. EDR coverage review: confirm your EDR hooks cover WoW64 direct-syscall stubs and 32-to-64-bit transitions; both loaders specifically evade user-mode hooks. Behavioural detection of module stomping (legitimate dbghelp.dll code section overwritten post-load) and fiber-based execution should be enabled where supported.
2. Application control: block execution of DLLs from WebDAV/UNC paths (WDAC/AppLocker DLL rules covering remote paths), and restrict rundll32.exe ordinal-based execution of non-standard extensions.
3. Blockchain RPC egress: if workstation access to public BNB Smart Chain RPC endpoints has no business justification, block it — it is used twice in this chain (delivery and payload C2 resolution).

5. Indicators of compromise

Note on the last row: Talos states the Amatera payload was recovered only as a memory-resident artifact and that its hash is included in their IOC list (published at their GitHub repository, linked in §7), but the hash value itself is not reproduced in the source text provided to us. We do not reproduce hashes we cannot verify verbatim; retrieve it from the Talos GitHub IOC repository. All indicators above are single-sourced (Cisco Talos) — verify before enforcement.

domain  leaguejazire[.]com
domain  riyazinikokar[.]xyz
ipv4  145.249.109[.]147
ipv4  45.150.34[.]2
domain  update[.]dubbedmuch[.]cc
domain  kr[.]cedar2glanz[.]ru
domain  phys[.]stunned-amniotic[.]com
domain  paternal-angrily[.]com
ipv4  212.118.56[.]166
domain  lb[.]propertyfind[.]cc
domain  static[.]quorashift[.]cc
domain  kffd3[.]vexlatech[.]cc
domain  kffd3[.]vogueatelier[.]cc
domain  pkg[.]vogueatelier[.]cc
domain  fd[.]gstats-api-contact[.]cc
url  hxxps://telegra[.]ph/Functions-04-03
url  hxxps://kr[.]cedar2glanz[.]ru/jewel[.]js
url  hxxps://phys[.]stunned-amniotic[.]com/hub[.]log
sha256  279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92
sha256  643ef35536ff9273fb84b8504467b1a5645cd3ffd5476d64b99244b02131b205
sha256  1819827e17f31e72d456158b6b9c90af25a65945f6f05d04a060da9f24179b25
sha256  bd36f4c15fe0acb6748da5ed12e45dcc37d412385812c078d1e4f04730e9f69b
filename  verification.google
filename  pf.ch
filename  platform_experience_helper.exe
filename  Secur32.dll
filename  dbghelp.dll
filename  DCRCVDrv.sys
filename  hypersnap.exe
filename  PCICL32.DLL
filename  client32.ini
mutex  hit

6. Detection

rule Amatera_WebDAV_Loader_pfch {
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/"
        description = "Detects the pf.ch packed WebDAV loader: single named export 'moor', minimal import table, 'hit' event name"
    strings:
        $export = "moor" ascii
        $imp1 = "AddVectoredExceptionHandler" ascii
        $imp2 = "__mb_cur_max" ascii
        $event = "hit" ascii
    condition:
        uint16(0) == 0x5a4d and all of them
}

rule Amatera_Payload_Strings {
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/"
        description = "Detects Amatera stealer build label and dead-drop resolver artefacts"
    strings:
        $build = "4.1.5-alpha" ascii
        $ddr1 = "GETWELLV2" ascii
        $ddr2 = "telegra.ph/Functions-04-03" ascii
        $xor_key = "852149723" ascii
    condition:
        uint16(0) == 0x5a4d and 2 of them
}

rule ZigCryptoStealer_NativeAOT_Loader {
    meta:
        author = "Adverse Trace"
        date = "2026-09-08"
        reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/"
        description = "Detects the NativeAOT Secur32.dll side-load loader and BYOVD driver artefacts"
    strings:
        $drv1 = "DCRCVDrv.sys" ascii
        $drv2 = "DCRCV_U Driver (for SCM)" ascii
        $drv3 = "MOCOMSYS" ascii
        $dev = "DCRCVDRV_U" ascii
    condition:
        2 of them
}

title: WebDAV DLL execution via 32-bit rundll32.exe - ClearFake/Amatera chain
id: 7c1f2a44-8b3e-4d19-9f6a-2e5c8d1b7a30
status: experimental
description: Detects execution of a DLL from a WebDAV UNC path through the 32-bit rundll32.exe, the execution primitive of the ClearFake WebDAV / Amatera chain documented by Cisco Talos.
references:

    - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
tags:

    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll32:
        Image|endswith: '\SysWOW64\rundll32.exe'
    selection_webdav:
        CommandLine|contains:

            - 'DavWWWRoot'
            - '\\leaguejazire.com\'
    filter_legitimate:
        CommandLine|contains:

            - 'C:\Windows\'
    condition: selection_rundll32 and selection_webdav and not filter_legitimate
falsepositives:

    - Legitimate WebDAV-based application launches from 32-bit rundll32 (rare; verify path and domain)
level: high
---
title: Suspicious scheduled task at logon launching hypersnap.exe from AppData - NetSupport Manager install
id: 3a9d5c71-2f4b-4e8a-b6c0-9d1e7f3a5b82
status: experimental
description: Detects the persistence mechanism of the unauthorised NetSupport Manager deployment in the verification.google branch of the ClearFake/Amatera chain.
references:

    - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
logsource:
    category: process_creation
    product: windows
detection:
    selection_task:
        ParentCommandLine|contains|all:

            - 'schtasks'
            - 'logon'
    selection_target:
        CommandLine|contains|all:

            - '\AppData\'
            - 'hypersnap.exe'
    condition: 1 of them
falsepositives:

    - HyperSnap screenshot tool legitimately installed per-user (verify signer and client32.ini presence)
level: high

7. Sources

• Cisco Talos, "ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager", https://blog.talosintelligence.com/clearfake-webdav-infection-chain/, 2026-09-08

8. Adverse Trace position

This is a high-impact commodity chain with an escalation path that matters to financial services: broad, non-targeted distribution (Umbrella DNS queries from up to 98 countries) via a social-engineering gate that requires only one careless paste action, followed by memory-resident credential and wallet theft at scale, and — in the "verification.google" branch — persistent, operator-controlled remote access through a silently configured NetSupport Manager client polling Russia-based infrastructure every 60 seconds. The BYOVD EDR-termination capability means clients should not assume their endpoint agent survives an infection of the "pf.ch" branch; detection must lean on the WebDAV execution pattern, network IOCs, and behavioural signals rather than trusting the EDR process itself post-compromise. Attribution is unconfirmed: the tracked actor UAT-10820 has no MITRE ATT&CK profile in our verified reference data, and Talos's Russian-actor assessment for the "verification.google" branch is moderate-confidence and single-sourced. All IOCs in this advisory derive from a single vendor report — verify before enforcement actions such as wholesale domain blocks. We will monitor the Talos GitHub IOC repository for the memory-derived Amatera hash, track the ZigCryptoStealer contract (0x7CC3cFC1Ac007B8c6566fD2C7419b15a75473468) for new setData rotations, and update clients if the two chains are confirmed identical or if additional Amatera delivery chains sharing this infrastructure emerge.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.