Executive Summary
A sophisticated multi-stage intrusion was observed starting with a 'ClickFix' social engineering prompt that tricked a user into executing a malicious command. The attack chain utilized a custom x64 loader named Potemkin, which uses a deterministic Domain Generation Algorithm (DGA) to deliver RMMProject. RMMProject is a highly capable Remote Access Trojan (RAT) featuring browser credential theft—specifically bypassing Chrome's App-Bound Encryption (ABE)—and a hidden-desktop remote control module.
The intrusion escalated into a hands-on-keyboard campaign where the attacker fought Windows Defender through repeated AMSI patching, registry policy manipulation, and exclusion path abuse before ultimately disabling the service. The operator successfully moved laterally to 11 hosts, including a Domain Controller, using WMIExec and SMBExec (Impacket) to deploy EtherRAT, a Node.js backdoor that resolves its command-and-control (C2) infrastructure via the Ethereum blockchain (EtherHiding).