We've got one word for it, and it's usually the wrong one

1. Executive summary

Cisco Talos is disclosing a WebDAV-based infection chain — investigated after an incident at a Ukrainian government organisation — that delivers the Amatera stealer alongside secondary payloads including ZigCryptoStealer and an unauthorised NetSupport Manager remote access installation. The activity is attributed by Talos to a Russian threat actor tracked as UAT-10820; this actor has no MITRE ATT&CK profile, so attribution should be treated as unconfirmed pending independent corroboration. Talos assesses with moderate confidence that this is an opportunistic, broad-based cryptocurrency and credential-stealing operation, not a targeted attack on the initial victim — meaning EMEA financial services endpoints are plausibly in scope despite the government-sector initial sighting. The chain abuses legitimate infrastructure (BNB Smart Chain smart-contract storage for payload hosting, fake CAPTCHA/"ClickFake" lures, WebDAV UNC execution via rundll32.exe), includes a vulnerable driver used to terminate EDR software, and the primary Amatera payload resides largely in memory — both of which degrade standard web-filter and endpoint controls.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item: the activity is an opportunistic crimeware campaign with no confirmed incident at an EMEA financial entity, and nothing in the source ties it to a specific supply-chain or reporting trigger.

3. Technical analysis & attack chain

Confirmed attack chain (as recovered by Talos; some stages inferred — see caveat)

1. Initial access — ClearFake injection. A compromised website has malicious JavaScript injected into its content by a malicious Cloudflare Worker. The victim is presented with a fake CAPTCHA/verification prompt (ClickFake pattern) instructing them to copy and paste a command.
2. Blockchain-hosted stage retrieval (EtherHiding). The injected JavaScript queries BNB Smart Chain testnet contract 0x886d310Ac23e05EA705e24E513D19f53793832A9 via bsc-testnet-rpc[.]publicnode[.]com. The actor uses the contract as remotely changeable storage for encoded JavaScript; the blockchain acts as bulletproof hosting. Based on the victim's OS, the retrieved JavaScript pulls the next stage. (Potent Pages previously documented unauthorised Cloudflare Workers querying the same first-stage contract.)
3. WebDAV DLL execution. A DLL hosted on a WebDAV share is launched over a UNC path through the 32-bit rundll32.exe using ordinal calls, with the Windows WebClient service starting as part of the execution. Observed disguised loader filenames: verification.google (the initial Ukrainian government victim, April 2026) and pf.ch (recovered via VirusTotal hunting).
4. Primary payload — Amatera stealer. The Amatera payload often resides entirely in memory, per Talos, which is why robust endpoint memory scanning is called out as a defensive requirement.
5. C2-driven secondary payloads. The C2 server returns configuration instructing the stealer to download additional components: - DLL side-loading package: a signed Chrome component side-loads a malicious NativeAOT DLL named secur32.dll. That DLL loads ZigCryptoStealer and uses a vulnerable driver to terminate EDR software (EDR-killer technique). - x86 shellcode loader containing a Go reverse TCP proxy (secondary payload in the Amatera configuration). - verification.google branch: a PowerShell script that attempts to install a sample of NetSupport Manager remote access tool, giving attackers deep, persistent control.

Observed impact: cryptocurrency and credential theft; EDR termination; unauthorised remote access. Talos explicitly notes the secondary payloads "pack a serious punch" — the vulnerable driver plus RAT deployment give persistent control beyond a typical stealer.

Confidence caveats

• Attribution to UAT-10820 is unconfirmed. The actor has no MITRE ATT&CK profile in our verified reference data; the attribution rests on Talos's tracking alone and should not be used for enforcement or reporting decisions without corroboration.
• The two delivery chains (verification.google and pf.ch) were not directly observed end-to-end. Talos assesses with low-to-medium confidence that they are identical; dashed stages in their analysis were inferred, not recovered.
• The full chain is single-sourced (one vendor report — Cisco Talos). The July 2026 Malwarebytes (RenPy Loader/MSBuild/EtherHiding) and Blackpoint Cyber (signed App-V script, Google Calendar config, PNG-concealed payload) Amatera campaigns share the payload family but no common infrastructure with these chains per Talos — do not conflate them in tracking.
• The "Russian threat actor" characterisation of UAT-10820 comes from the newsletter text only; we have no independent corroboration of origin.

4. Mitigation & containment

P1 — within 24 hours

• Hunt for the chain, not just the hashes. Search endpoint telemetry for: rundll32.exe (specifically the 32-bit binary) executing a DLL from a WebDAV UNC path (\\...\ invocation) with ordinal-style exports; the Windows WebClient service starting in proximity to such execution. Filenames verification.google and pf.ch executed via rundll32 are high-signal.
• Block/monitor WebDAV egress: restrict outbound WebDAV (typically TCP 80/443 with WebDAV methods — PROPFIND, OPTIONS) from user workstations, or disable the WebClient service where not required.
• Block the known blockchain retrieval path: monitor/deny endpoint queries to bsc-testnet-rpc[.]publicnode[.]com and any client-side access to BNB Smart Chain testnet contract 0x886d310Ac23e05EA705e24E513D19f53793832A9. Financial-sector endpoints should generally not be reaching public blockchain RPC endpoints.
• Verify EDR health: the chain terminates EDR via a vulnerable driver — check for tamper-protection status, unexpected driver loads, and EDR process termination events across the estate.
• Block the five file hashes in §5 at email gateway, web proxy and endpoint.

P2 — within 72 hours

• Enable/verify robust memory scanning in endpoint tooling — Talos states the Amatera payload often resides entirely in memory, so on-access file scanning alone will miss it.
• Detect unauthorised NetSupport Manager: inventory for NetSupport Manager binaries/processes (client32.exe-class RAT traffic is not in the source — do not block on that name; instead alert on any NetSupport Manager installation event not tied to an approved change record). The PowerShell install attempt should be caught by constrained-language mode or AMSI.
• Detect the side-load: alert on secur32.dll loaded from a non-system path, and on signed Chrome components executing outside the Chrome installation directory.
• User education: warn staff specifically about copying and pasting commands from fake verification/CAPTCHA prompts (ClickFake) — Talos calls this out directly.

P3 — within 7 days

• Review proxy policy on legitimate-infrastructure abuse: Cloudflare Workers and Google-hosted content are used across the current campaign set (the same newsletter covers a Google Visualization API C2 campaign retrieving obfuscated JavaScript from a published Google Sheets document); ensure egress inspection does not blanket-trust major-CDN/major-cloud domains.
• Threat-led testing: add this chain (ClickFake → blockchain retrieval → WebDAV ordinal execution → memory-resident stealer → EDR termination → RAT) to purple-team scenarios, per the DORA Art. 24 trigger above.

5. Indicators of compromise

Note: the IOC set is single-sourced (Cisco Talos only) — verify against your own telemetry before enforcement action.

sha256  9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
md5  2915b3f8b703eb744fc54c81f4a9c67f
sha256  90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59
md5  c2efb2dcacba6d3ccc175b6ce1b7ed0a
sha256  c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2
md5  9a47c4d379998ade2f8f99e23a630c06
sha256  9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
md5  38de5b216c33833af710e88f7f64fc98
sha256  5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811
md5  f3e82419a43220a7a222fc01b7607adc
domain  bsc-testnet-rpc[.]publicnode[.]com
contract  0x886d310Ac23e05EA705e24E513D19f53793832A9
filename  verification.google
filename  pf.ch
filename  secur32.dll
filename  VID001.exe
filename  tmp00055df5.dll
filename  sample.exe
filename  SECOH-QAD.exe

Behavioural indicators (no atomic IOC covers these):

6. Detection

import "pe"

rule Amatera_WebDAV_Chain_Loaders_UAT10820
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-10"
        reference = "https://blog.talosintelligence.com/clearfake-webdav-infection-chain/"
        description = "Detection of file artefacts from the UAT-10820 WebDAV/Amatera infection chain: disguised WebDAV loaders (verification.google, pf.ch), NativeAOT side-load DLL secur32.dll, and known sample filenames. Hashes from Talos IOC list."
    hash:
        $sha1 = "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507"
        $sha2 = "90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59"
        $sha3 = "c4dd71e347a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2"
        $sha4 = "9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f"
        $sha5 = "5bb86c1cd08fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811"

    condition:
        1 of ($sha*)
}

Note: the YARA rule above is hash-based because the source material provides hashes and filenames but no distinctive embedded strings, mutexes or registry keys from the payloads themselves. The hash module usage requires enabling it; alternatively match the same values in your EDR's hash-blocklist. The filenames verification.google and pf.ch are better covered by the Sigma rules below than by YARA, since the malicious content is what is named, not what is inside.

title: WebDAV DLL Execution via rundll32.exe with Ordinal Calls (UAT-10820 / Amatera Chain)
id: 8a1f0c32-4d5e-4f6a-9b7c-1d2e3f4a5b6c
status: experimental
description: Detects execution of a DLL from a WebDAV UNC path through rundll32.exe, as observed in the UAT-10820 Amatera infection chain (loader filenames "verification.google", "pf.ch"). Also catches the Windows WebClient service starting alongside such execution.
references:

    - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
author: Adverse Trace
date: 2026-09-10
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:

            - '\\\\'
            - 'verification.google'
            - 'pf.ch'
    filter legitimate:
        CommandLine|contains:

            - 'C:\Windows\'
            - 'C:\Program Files'
    condition: selection_rundll and not filter legitimate
falsepositives:

    - Legitimate software invoking rundll32 against UNC paths (rare in managed estates)
level: high

title: NetSupport Manager Installation Attempt via PowerShell (Amatera Secondary Payload)
id: 9b2e1d43-5f6a-4b7c-8d9e-2f3a4b5c6d7e
status: experimental
description: Detects PowerShell attempting to install NetSupport Manager, the secondary payload of the UAT-10820 "verification.google" branch. Tune against approved NetSupport deployments.
references:

    - https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
author: Adverse Trace
date: 2026-09-10
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:

            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:

            - 'NetSupport'
            - 'NetSupport Manager'
    condition: selection_powershell
falsepositives:

    - Approved NetSupport Manager software deployment scripts
level: high

7. Sources

• Cisco Talos — We've got one word for it, and it's usually the wrong one (Threat Source newsletter, disclosing the WebDAV/Amatera chain and IOC list) — https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/ — 2026-09-10
• Cisco Talos — ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager — https://blog.talosintelligence.com/clearfake-webdav-infection-chain/ — 2026 (primary technical detail; full chain, contract address, RPC endpoint, loader names, side-load package)

8. Adverse Trace position

This is a capable, evasion-heavy crimeware chain that financial services clients should treat as a realistic endpoint threat now: it defeats web filtering via legitimate infrastructure (BNB Smart Chain, Cloudflare Workers), defeats naive endpoint detection via memory residency and EDR termination, and escalates a routine stealer into persistent access via NetSupport Manager. Severity is high for endpoint exposure, moderate for enterprise-wide risk — Talos's own moderate-confidence assessment is that this is opportunistic, not targeted, so the risk is one of random employee exposure rather than deliberate intrusion, but the EDR-kill and RAT stages mean any hit must be treated as a potential incident, not adware cleanup. Attribution to UAT-10820 is unconfirmed (no MITRE profile; single-sourced to Talos) and should not drive response decisions. The IOC set is likewise single-sourced — verify before enforcement. We will monitor for the full Talos blog's additional IOCs, for independent corroboration of the attribution, and for any EMEA financial-sector sightings of the chain, and will reissue if the picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.