> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # We've got one word for it, and it's usually the wrong one - URL: https://f4n6.co.uk/security-feed/weve-got-one-word-for-it-and-its-usually-the-wrong-one/ - Published: 2026-09-11T12:01:25.000Z - Updated: 2026-09-11T12:01:25.000Z - Author: Jeff Davies - Tags: #security-feed, UAT-10820 ## 1\. Executive summary Cisco Talos is disclosing a WebDAV-based infection chain — investigated after an incident at a Ukrainian government organisation — that delivers the **Amatera stealer** alongside secondary payloads including **ZigCryptoStealer** and an unauthorised **NetSupport Manager** remote access installation. The activity is attributed by Talos to a Russian threat actor tracked as **UAT-10820**; this actor has **no MITRE ATT&CK profile**, so attribution should be treated as **unconfirmed** pending independent corroboration. Talos assesses with moderate confidence that this is an **opportunistic, broad-based cryptocurrency and credential-stealing operation**, not a targeted attack on the initial victim — meaning EMEA financial services endpoints are plausibly in scope despite the government-sector initial sighting. The chain abuses legitimate infrastructure (BNB Smart Chain smart-contract storage for payload hosting, fake CAPTCHA/"ClickFake" lures, WebDAV UNC execution via `rundll32.exe`), includes a **vulnerable driver used to terminate EDR software**, and the primary Amatera payload **resides largely in memory** — both of which degrade standard web-filter and endpoint controls. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | The disclosed chain terminates EDR software via a vulnerable driver and installs unauthorised remote access (NetSupport Manager), meaning a successful infection is plausibly a major ICT incident with attacker-controlled persistence — clients must be able to classify and report such an event, per the classification process. | Pre-stage the incident classification and reporting workflow for stealer-plus-RAT infections so the Art. 19 decision (fed by Art. 18 classification) can be made inside the reporting window if this chain is observed. | | DORA Art. 24: digital operational resilience testing — general requirements | The chain defeats controls through abuse of legitimate infrastructure (BNB Smart Chain RPC, WebDAV, Cloudflare Workers) and memory-resident payloads — resilience testing should cover these specific evasion paths, not just signature efficacy. | Include WebDAV/UNC execution, blockchain-hosted payload retrieval and memory-scanning efficacy in the threat-led testing scope. | No NIS2 or UK NIS article is directly engaged by this item: the activity is an opportunistic crimeware campaign with no confirmed incident at an EMEA financial entity, and nothing in the source ties it to a specific supply-chain or reporting trigger. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (as recovered by Talos; some stages inferred — see caveat) 1. **Initial access — ClearFake injection.** A compromised website has malicious JavaScript injected into its content by a malicious Cloudflare Worker. The victim is presented with a fake CAPTCHA/verification prompt (ClickFake pattern) instructing them to copy and paste a command. 2. **Blockchain-hosted stage retrieval (EtherHiding).** The injected JavaScript queries BNB Smart Chain **testnet contract `0x886d310Ac23e05EA705e24E513D19f53793832A9`** via `bsc-testnet-rpc[.]publicnode[.]com`. The actor uses the contract as remotely changeable storage for encoded JavaScript; the blockchain acts as bulletproof hosting. Based on the victim's OS, the retrieved JavaScript pulls the next stage. (Potent Pages previously documented unauthorised Cloudflare Workers querying the same first-stage contract.) 3. **WebDAV DLL execution.** A DLL hosted on a WebDAV share is launched over a UNC path through the **32-bit `rundll32.exe`** using **ordinal calls**, with the **Windows WebClient service** starting as part of the execution. Observed disguised loader filenames: **`verification.google`** (the initial Ukrainian government victim, April 2026) and **`pf.ch`** (recovered via VirusTotal hunting). 4. **Primary payload — Amatera stealer.** The Amatera payload **often resides entirely in memory**, per Talos, which is why robust endpoint memory scanning is called out as a defensive requirement. 5. **C2-driven secondary payloads.** The C2 server returns configuration instructing the stealer to download additional components: - **DLL side-loading package:** a **signed Chrome component** side-loads a malicious **NativeAOT DLL named `secur32.dll`**. That DLL loads **ZigCryptoStealer** and uses a **vulnerable driver to terminate EDR software** (EDR-killer technique). - **x86 shellcode loader** containing a **Go reverse TCP proxy** (secondary payload in the Amatera configuration). - **`verification.google` branch:** a **PowerShell script** that attempts to install a sample of **NetSupport Manager** remote access tool, giving attackers deep, persistent control. **Observed impact:** cryptocurrency and credential theft; EDR termination; unauthorised remote access. Talos explicitly notes the secondary payloads "pack a serious punch" — the vulnerable driver plus RAT deployment give persistent control beyond a typical stealer. ### Confidence caveats - **Attribution to UAT-10820 is unconfirmed.** The actor has no MITRE ATT&CK profile in our verified reference data; the attribution rests on Talos's tracking alone and should not be used for enforcement or reporting decisions without corroboration. - **The two delivery chains (`verification.google` and `pf.ch`) were not directly observed end-to-end.** Talos assesses with **low-to-medium confidence** that they are identical; dashed stages in their analysis were inferred, not recovered. - **The full chain is single-sourced** (one vendor report — Cisco Talos). The July 2026 Malwarebytes (RenPy Loader/MSBuild/EtherHiding) and Blackpoint Cyber (signed App-V script, Google Calendar config, PNG-concealed payload) Amatera campaigns share the payload family but **no common infrastructure** with these chains per Talos — do not conflate them in tracking. - The "Russian threat actor" characterisation of UAT-10820 comes from the newsletter text only; we have no independent corroboration of origin. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Hunt for the chain, not just the hashes.** Search endpoint telemetry for: `rundll32.exe` (specifically the 32-bit binary) executing a DLL from a **WebDAV UNC path** (`\\...\` invocation) with **ordinal-style exports**; the **Windows WebClient service** starting in proximity to such execution. Filenames `verification.google` and `pf.ch` executed via rundll32 are high-signal. - **Block/monitor WebDAV egress:** restrict outbound WebDAV (typically TCP 80/443 with WebDAV methods — `PROPFIND`, `OPTIONS`) from user workstations, or disable the WebClient service where not required. - **Block the known blockchain retrieval path:** monitor/deny endpoint queries to `bsc-testnet-rpc[.]publicnode[.]com` and any client-side access to BNB Smart Chain testnet contract `0x886d310Ac23e05EA705e24E513D19f53793832A9`. Financial-sector endpoints should generally not be reaching public blockchain RPC endpoints. - **Verify EDR health:** the chain terminates EDR via a vulnerable driver — check for tamper-protection status, unexpected driver loads, and EDR process termination events across the estate. - **Block the five file hashes** in §5 at email gateway, web proxy and endpoint. ### P2 — within 72 hours - **Enable/verify robust memory scanning** in endpoint tooling — Talos states the Amatera payload often resides entirely in memory, so on-access file scanning alone will miss it. - **Detect unauthorised NetSupport Manager:** inventory for NetSupport Manager binaries/processes (`client32.exe`\-class RAT traffic is not in the source — do not block on that name; instead alert on any NetSupport Manager installation event not tied to an approved change record). The PowerShell install attempt should be caught by constrained-language mode or AMSI. - **Detect the side-load:** alert on `secur32.dll` loaded from a non-system path, and on signed Chrome components executing outside the Chrome installation directory. - **User education:** warn staff specifically about copying and pasting commands from fake verification/CAPTCHA prompts (ClickFake) — Talos calls this out directly. ### P3 — within 7 days - **Review proxy policy on legitimate-infrastructure abuse:** Cloudflare Workers and Google-hosted content are used across the current campaign set (the same newsletter covers a Google Visualization API C2 campaign retrieving obfuscated JavaScript from a published Google Sheets document); ensure egress inspection does not blanket-trust major-CDN/major-cloud domains. - **Threat-led testing:** add this chain (ClickFake → blockchain retrieval → WebDAV ordinal execution → memory-resident stealer → EDR termination → RAT) to purple-team scenarios, per the DORA Art. 24 trigger above. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | -------- | -------------------------------------------------------------------- | ----------------------- | ----------- | | sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | High (vendor-published) | Cisco Talos | | md5 | 2915b3f8b703eb744fc54c81f4a9c67f | High (vendor-published) | Cisco Talos | | filename | VID001.exe | High | Cisco Talos | | sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | High (vendor-published) | Cisco Talos | | md5 | c2efb2dcacba6d3ccc175b6ce1b7ed0a | High (vendor-published) | Cisco Talos | | filename | tmp00055df5.dll | High | Cisco Talos | | sha256 | c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 | High (vendor-published) | Cisco Talos | | md5 | 9a47c4d379998ade2f8f99e23a630c06 | High (vendor-published) | Cisco Talos | | filename | sample.exe | High | Cisco Talos | | sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | High (vendor-published) | Cisco Talos | | md5 | 38de5b216c33833af710e88f7f64fc98 | High (vendor-published) | Cisco Talos | | filename | SECOH-QAD.exe | High | Cisco Talos | | sha256 | 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 | High (vendor-published) | Cisco Talos | | md5 | f3e82419a43220a7a222fc01b7607adc | High (vendor-published) | Cisco Talos | | filename | 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811.exe | High | Cisco Talos | | domain | bsc-testnet-rpc\[.\]publicnode\[.\]com | High | Cisco Talos | | contract | 0x886d310Ac23e05EA705e24E513D19f53793832A9 | High | Cisco Talos | | filename | verification.google | High | Cisco Talos | | filename | pf.ch | High | Cisco Talos | | filename | secur32.dll (NativeAOT, side-loaded by signed Chrome component) | High | Cisco Talos | Note: the IOC set is **single-sourced** (Cisco Talos only) — verify against your own telemetry before enforcement action. ```iocs sha256 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 md5 2915b3f8b703eb744fc54c81f4a9c67f sha256 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 md5 c2efb2dcacba6d3ccc175b6ce1b7ed0a sha256 c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 md5 9a47c4d379998ade2f8f99e23a630c06 sha256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f md5 38de5b216c33833af710e88f7f64fc98 sha256 5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 md5 f3e82419a43220a7a222fc01b7607adc domain bsc-testnet-rpc[.]publicnode[.]com contract 0x886d310Ac23e05EA705e24E513D19f53793832A9 filename verification.google filename pf.ch filename secur32.dll filename VID001.exe filename tmp00055df5.dll filename sample.exe filename SECOH-QAD.exe ``` **Behavioural indicators** (no atomic IOC covers these): | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------- | ----------------------------------------------------- | --------------------------------------------------------------------------- | | rundll32.exe (32-bit) executing a DLL from a WebDAV UNC path with ordinal calls | Endpoint process telemetry (command line, image path) | High — directly observed at the initial victim | | Windows WebClient service starting in proximity to the above execution | Service control manager / EDR service events | High — directly observed | | Endpoint retrieving JavaScript from BNB Smart Chain testnet via public RPC | Proxy/DNS egress logs | Medium — recovered chain, low-to-medium confidence the chains are identical | | PowerShell attempting to install NetSupport Manager | PowerShell script-block logging / AMSI | Medium — verification.google branch | | EDR processes terminated following a driver load | EDR tamper logs, driver load events | Medium — described capability, not tied to a specific observed sample | ## 6\. Detection ```yara import "pe" rule Amatera_WebDAV_Chain_Loaders_UAT10820 { meta: author = "Adverse Trace" date = "2026-09-10" reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/" description = "Detection of file artefacts from the UAT-10820 WebDAV/Amatera infection chain: disguised WebDAV loaders (verification.google, pf.ch), NativeAOT side-load DLL secur32.dll, and known sample filenames. Hashes from Talos IOC list." hash: $sha1 = "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507" $sha2 = "90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59" $sha3 = "c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2" $sha4 = "9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f" $sha5 = "5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811" condition: 1 of ($sha*) } ``` Note: the YARA rule above is hash-based because the source material provides hashes and filenames but no distinctive embedded strings, mutexes or registry keys from the payloads themselves. The `hash` module usage requires enabling it; alternatively match the same values in your EDR's hash-blocklist. The filenames `verification.google` and `pf.ch` are better covered by the Sigma rules below than by YARA, since the malicious content is what is named, not what is inside. ```yaml title: WebDAV DLL Execution via rundll32.exe with Ordinal Calls (UAT-10820 / Amatera Chain) id: 8a1f0c32-4d5e-4f6a-9b7c-1d2e3f4a5b6c status: experimental description: Detects execution of a DLL from a WebDAV UNC path through rundll32.exe, as observed in the UAT-10820 Amatera infection chain (loader filenames "verification.google", "pf.ch"). Also catches the Windows WebClient service starting alongside such execution. references: - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ author: Adverse Trace date: 2026-09-10 logsource: category: process_creation product: windows detection: selection_rundll: Image|endswith: '\rundll32.exe' CommandLine|contains: - '\\\\' - 'verification.google' - 'pf.ch' filter legitimate: CommandLine|contains: - 'C:\Windows\' - 'C:\Program Files' condition: selection_rundll and not filter legitimate falsepositives: - Legitimate software invoking rundll32 against UNC paths (rare in managed estates) level: high ``` ```yaml title: NetSupport Manager Installation Attempt via PowerShell (Amatera Secondary Payload) id: 9b2e1d43-5f6a-4b7c-8d9e-2f3a4b5c6d7e status: experimental description: Detects PowerShell attempting to install NetSupport Manager, the secondary payload of the UAT-10820 "verification.google" branch. Tune against approved NetSupport deployments. references: - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ author: Adverse Trace date: 2026-09-10 logsource: category: process_creation product: windows detection: selection_powershell: Image|endswith: - '\powershell.exe' - '\pwsh.exe' CommandLine|contains: - 'NetSupport' - 'NetSupport Manager' condition: selection_powershell falsepositives: - Approved NetSupport Manager software deployment scripts level: high ``` ## 7\. Sources - Cisco Talos — *We've got one word for it, and it's usually the wrong one* (Threat Source newsletter, disclosing the WebDAV/Amatera chain and IOC list) — https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/ — 2026-09-10 - Cisco Talos — *ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager* — https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ — 2026 (primary technical detail; full chain, contract address, RPC endpoint, loader names, side-load package) ## 8\. Adverse Trace position This is a capable, evasion-heavy crimeware chain that financial services clients should treat as a realistic endpoint threat now: it defeats web filtering via legitimate infrastructure (BNB Smart Chain, Cloudflare Workers), defeats naive endpoint detection via memory residency and EDR termination, and escalates a routine stealer into persistent access via NetSupport Manager. Severity is **high for endpoint exposure, moderate for enterprise-wide risk** — Talos's own moderate-confidence assessment is that this is opportunistic, not targeted, so the risk is one of random employee exposure rather than deliberate intrusion, but the EDR-kill and RAT stages mean any hit must be treated as a potential incident, not adware cleanup. Attribution to UAT-10820 is **unconfirmed** (no MITRE profile; single-sourced to Talos) and should not drive response decisions. The IOC set is likewise single-sourced — verify before enforcement. We will monitor for the full Talos blog's additional IOCs, for independent corroboration of the attribution, and for any EMEA financial-sector sightings of the chain, and will reissue if the picture changes. --- [Read the original source →](https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*