NetSupportManager RAT (Malware Family) By Fraunhofer FKIE Archived: 2026-04-05 14:11:10 UTC Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT. 2025-11-12 ⋅ ISC ⋅ SmartApeSG campaign uses ClickFix page to push NetSupport RAT SmartApeSG NetSupportManager RAT 2025-06-13 ⋅ Recorded Future ⋅ Insikt Group GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT EugenLoader POWERTRASH NetSupportManager RAT 2025-03-28 ⋅ Intrinsec ⋅ David Sardinha From espionage to PsyOps: Tracking operations and bulletproof providers of UACs in 2025 sLoad NetSupportManager RAT Remcos SmokeLoader 2025-03-12 ⋅ Red Canary ⋅ Red Canary 2025 Threat Detection Report HijackLoader Lumma Stealer NetSupportManager RAT 2025-02-04 ⋅ Team Cymru ⋅ S2 Research Team Tracing the Path From SmartApeSG to NetSupport RAT SmartApeSG NetSupportManager RAT Quasar RAT 2024-12-02 ⋅ Kaspersky Labs ⋅ Artem Ushkov Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT NetSupportManager RAT RMS 2024-11-18 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team, Selena Larson, Tommy Madjar Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape AsyncRAT Brute Ratel C4 DanaBot DarkGate Latrodectus Lumma Stealer NetSupportManager RAT XWorm 2024-07-25 ⋅ Symantec ⋅ Symantec Growing Number of Threats Leveraging AI Broomstick DBatLoader NetSupportManager RAT Rhadamanthys 2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue Exposing FakeBat loader: distribution methods and adversary infrastructure BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar 2024-06-17 ⋅ Proofpoint ⋅ Proofpoint From Clipboard to Compromise: A PowerShell Self-Pwn DarkGate HijackLoader Lumma Stealer Matanbuchus NetSupportManager RAT TA571 2024-06-11 ⋅ ThreatDown ⋅ Jérôme Segura SmartApeSG walkthrough SmartApeSG NetSupportManager RAT 2024-05-10 ⋅ Rapid7 Labs ⋅ Evan McCann, Thomas Elkins, Tyler McGraw Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators Black Basta Black Basta Cobalt Strike NetSupportManager RAT 2024-03-18 ⋅ Perception Point ⋅ Ariel Davidpur, Peleg Cabra https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat Page 1 of 3 Operation PhantomBlu: New and Evasive Method Delivers NetSupport RAT NetSupportManager RAT 2024-02-26 ⋅ Twitter (@embee_research) ⋅ Embee_research Advanced CyberChef Techniques for Configuration Extraction - Detailed Walkthrough and Examples NetSupportManager RAT 2024-02-25 ⋅ YouTube (Embee Research) ⋅ Embee_research My Longest CyberChef Recipe Ever - 22 Operation Configuration Extractor NetSupportManager RAT 2024-01-23 ⋅ Medium ad12347 ⋅ Ariel Davidpur NetSupport RAT hits again with new IOCs NetSupportManager RAT 2023-12-30 ⋅ Rewterz Information Security ⋅ Rewterz Information Security Rewterz Threat Alert – Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs EugenLoader POWERTRASH BATLOADER DarkGate FlawedGrace NetSupportManager RAT SectopRAT Storm-0506 2023-11-20 ⋅ vmware ⋅ Abe Schneider, Alan Ngo, Alex Murillo, Fae Carlisle, Nikki Benoit NetSupport RAT: The RAT King Returns NetSupportManager RAT 2023-10-27 ⋅ Elastic ⋅ Joe Desimone, Salim Bitam GHOSTPULSE haunts victims using defense evasion bag o' tricks HijackLoader Lumma Stealer NetSupportManager RAT Rhadamanthys SectopRAT Vidar 2023-10-26 ⋅ Medium walmartglobaltech ⋅ Jonathan Mccay SmartApeSG SmartApeSG NetSupportManager RAT 2023-09-06 ⋅ Malwarebytes ⋅ Jérôme Segura Mac users targeted in new malvertising campaign delivering Atomic Stealer AMOS NetSupportManager RAT 2023-08-10 ⋅ Trellix ⋅ Antonio Ribeiro, Jonell Baltazar Exploring New Techniques of Fake Browser Updates Leading to NetSupport RAT NetSupportManager RAT 2023-03-29 ⋅ Trend Micro ⋅ Jaromír Hořejší, Joseph C Chen New OpcJacker Malware Distributed via Fake VPN Malvertising NetSupportManager RAT OpcJacker 2023-01-06 ⋅ AhnLab ⋅ ASEC Distribution of NetSupport RAT Malware Disguised as a Pokemon Game NetSupportManager RAT 2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team PrivateLoader: the loader of the prevalent ruzki PPI service Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer 2022-05-25 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt SocGholish Campaigns and Initial Access Kit FAKEUPDATES Blister Cobalt Strike NetSupportManager RAT 2022-04-11 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU) Fake Chrome Setup Leads to NetSupportManager RAT and Mars Stealer Mars Stealer NetSupportManager RAT 2022-04-07 ⋅ Bleeping Computer ⋅ Bill Toulas Malicious web redirect service infects 16,500 sites to push malware NetSupportManager RAT 2022-04-07 ⋅ Avast Decoded ⋅ Jan Rubín, Pavel Novák Parrot TDS takes over web servers and threatens millions FAKEUPDATES Parrot TDS Parrot TDS WebShell NetSupportManager RAT 2020-11-02 ⋅ SUCURI ⋅ Denis Sinegubko CSS-JS Steganography in Fake Flash Player Update Malware magecart NetSupportManager RAT 2020-05-22 ⋅ Positive Technologies ⋅ PT ESC Threat Intelligence Operation TA505: investigating the ServHelper backdoor with NetSupport RAT. Part 2. https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat Page 2 of 3 NetSupportManager RAT ServHelper 2020-03-19 ⋅ Prevailion ⋅ Prevailion The Curious Case of the Criminal Curriculum Vitae LALALA Stealer NetSupportManager RAT Rekt Loader 2017-09-01 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan EITest: HoeflerText Popups Targeting Google Chrome Users Now Push RAT Malware NetSupportManager RAT 2016-09-30 ⋅ Bleeping Computer ⋅ Lawrence Abrams Hacked Steam accounts spreading Remote Access Trojan NetSupportManager RAT 2013-01-01 ⋅ NetSupport Manager ⋅ NetSupport Manager NetSupport Manager Website NetSupportManager RAT [TLP:WHITE] win_netsupportmanager_rat_auto (20251219 | Detects win.netsupportmanager_rat.) Source: https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat https://malpedia.caad.fkie.fraunhofer.de/details/win.netsupportmanager_rat Page 3 of 3