Executive Summary
AlienVault OTX and Censys researchers have identified an active campaign where the NetSupport Manager Remote Access Trojan (RAT) is delivered using an advanced steganographic technique. Attackers embed approximately 6.5 MB of encrypted payload data inside the `uuid` extension boxes of legitimate-looking MP4 video files. This method effectively bypasses magic-byte scanners and basic file-type validation that only inspect headers, as the containers maintain a valid ISO Base Media File Format (ISO-BMFF) structure.
The infection chain begins with PowerShell loaders that retrieve these fake MP4 files from Cloudflare-fronted domains, providing reputable CDN cover to evade domain reputation filters. Once the file is retrieved, the loader extracts and decrypts the NetSupport client, establishing persistent remote access. While no specific actor is named, the tradecraft overlaps significantly with ecosystems like SocGholish (FakeUpdates) and PhantomLoader.
This campaign represents a high risk to enterprise environments due to its ability to evade traditional perimeter defenses. NetSupport RAT footholds are frequently leveraged by access brokers for follow-on attacks, including credential theft, lateral movement, and ransomware deployment. Organizations should prioritize detection of anomalous script-based media downloads and NetSupport client artifacts in non-standard directories.