Executive Summary
Identified by SOCRadar, DOUBLECUP is a Russian Loader-as-a-Service (LaaS) active since June 2026, primarily supporting ClickFix social engineering campaigns. The service operates via a client-server architecture where operators use a Go-based GUI to configure campaigns that deliver payloads through steganographic PNG images and environmental keying.
The technical execution chain is notable for its evasion techniques, including the use of the victim's public IP address as a cryptographic key to prevent sandbox analysis. Payloads include CountLoader v4.5p, which has evolved into a fileless PowerShell-based tool with PE-header patching capabilities, and DeviceManager, a modular Python RAT. DeviceManager represents a sophisticated shift in C2 infrastructure, utilizing EtherHiding to resolve its command-and-control nodes via Ethereum/Polygon smart contracts and employing DNS tunneling to mimic legitimate Microsoft telemetry.
This development signifies a high degree of operational maturity in the LaaS market, lowering the barrier for entry for actors while complicating detection through advanced obfuscation and decentralized infrastructure. Organizations should prioritize monitoring for anomalous clipboard activities and high-volume DNS TXT queries.
Key Details
Threat Name
DOUBLECUP LaaS
Affects
—
Adversary
Rognar
MITRE Techniques
Malware/Tools
DOUBLECUP, CountLoader, DeviceManager