English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어

#netsupport search results

James_inthe_box's profile picture.
James
 @James_inthe_box
Jan 22

#webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA

James_inthe_box's tweet image. #webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA
2
7
26
8
4K
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 24

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
17
68
22
11K
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 21

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
32
14K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Sep 29, 2023

This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…

1ZRR4H's tweet image. This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…
11
40
186
62
63K
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Jul 21

5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT

skocherhan's tweet image. 5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT
0
1
2
0
248
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Jan 30, 2023

Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm

1ZRR4H's tweet image. Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm
5
9
26
4
13K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Apr 5, 2024

🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…

1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1
8
46
8
4K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Dec 2, 2023

🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…

1ZRR4H's tweet image. 🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…
0
18
62
9
19K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Jan 24, 2024

Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…

1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
2
17
39
7
6K
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Oct 8

#netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2

JAMESWT_WT's tweet image. #netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2
1
6
21
0
2K
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
Aug 6

'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)

smica83's tweet image. 'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)
2
4
15
1
742
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Oct 22

#netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500

JAMESWT_WT's tweet image. #netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500
1
3
26
3
2K
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Sep 17

#NetSupport #Rat Samples Collection Updated/Tagged 👇 bazaar.abuse.ch/browse/signatu…

JAMESWT_WT's tweet image. #NetSupport #Rat Samples Collection Updated/Tagged 👇 bazaar.abuse.ch/browse/signatu…
1
0
8
0
836
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Aug 26

#netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…

JAMESWT_WT's tweet image. #netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…
JAMESWT_WT's tweet image. #netsupport submission from bazaar.abuse.ch/user/10197/ User "monitorsg"💯😎👍 Today I finished to add gateway ip tag to all samples from 2025 to 2023 👇 bazaar.abuse.ch/browse/tag/Sma…
0
3
10
0
884
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Sep 19

#netsupport #rat client32.ini MD5 15d827801ccc1c544cbcd6ddf737d19f stenslie.]com:3085 itnblog.]com:3085 MD5 daa0f1d6b1856657445c4d0261db38fd 45.88.104.]5:443 MD5 a7ac424709447b46683d018ba7dac685 95.179.154.]161:443 1/2 cc @500mk500

JAMESWT_WT's tweet image. #netsupport #rat client32.ini MD5 15d827801ccc1c544cbcd6ddf737d19f stenslie.]com:3085 itnblog.]com:3085 MD5 daa0f1d6b1856657445c4d0261db38fd 45.88.104.]5:443 MD5 a7ac424709447b46683d018ba7dac685 95.179.154.]161:443 1/2 cc @500mk500
1
3
9
2
3K
solicydotnet's profile picture. Helping projects achieve growth and scalability in the decentralized world through cutting-edge #development and innovative #Web3 solutions.
Solicy
@solicydotnet
Jan 9, 2023

❌ WARNING 🚨 Hackers have used a well-crafted #PokemonNFT card game website to distribute the #NetSupport remote access tool 💀 They can now remotely connect to a user's device to steal data, install other malware, etc #pokemonCards #Hacked #GamingNews #NFTs

solicydotnet's tweet image. ❌ WARNING 🚨 Hackers have used a well-crafted #PokemonNFT card game website to distribute the #NetSupport remote access tool 💀 They can now remotely connect to a user's device to steal data, install other malware, etc #pokemonCards #Hacked #GamingNews #NFTs
0
6
20
0
277
nettrke's profile picture. This is the official account of The National Environment Tribunal
NATIONAL ENVIRONMENT TRIBUNAL
 @nettrke
Sep 29, 2023

📣 Need to get in touch with NET? 🤝 We are here to help. For any inquiries, questions, or assistance, you can contact us through the following channels. Our team is ready to assist you! Don't hesitate to reach out. 🔗 #ContactUs #NETSupport

nettrke's tweet image. 📣 Need to get in touch with NET? 🤝 We are here to help. For any inquiries, questions, or assistance, you can contact us through the following channels. Our team is ready to assist you! Don't hesitate to reach out. 🔗 #ContactUs #NETSupport
0
0
1
0
104
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 24

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
17
68
22
11K
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Oct 24

eSentire TRU uncovered multiple 2025 campaigns abusing NetSupport Manager via ClickFix, using PowerShell/JSON, Run Prompt loaders, and MSI installers. Activity grouped into EVALUSION, FSHGDREE32/SGI, and XMLCTL actors. #RemoteAccess #NetSupport ift.tt/cmj49uw

TweetThreatNews's tweet card. eSentire's TRU investigated numerous 2025 incidents where threat actors abused legitimate NetSupport Manager RMM, primarily delivered via the ClickFix social engineering vector and executed through...
Unpacking NetSupport RAT Loaders Delivered via ClickFix
Source: hendryadrian.com
0
0
1
0
123
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Oct 23

gatewayaddress[.]benafaciario[.]com secondarygoteway[.]chiklx[.]com balofult[.]com mugolens[.]com chiklx[.]com benafaciario[.]com 88[.]214[.]27[.]48:444 AS209272 Alviva Holding Limited 🇩🇪 #NetSupport

skocherhan's tweet image. gatewayaddress[.]benafaciario[.]com secondarygoteway[.]chiklx[.]com balofult[.]com mugolens[.]com chiklx[.]com benafaciario[.]com 88[.]214[.]27[.]48:444 AS209272 Alviva Holding Limited 🇩🇪 #NetSupport
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
Oct 23

'dynatrc.ps1' is a new record for @nextronresearch with 9 thor detection hit. bazaar.abuse.ch/sample/33c017a… URL: hxxp://144.31.0(.)44/dynatrc.php

smica83's tweet image. 'dynatrc.ps1' is a new record for @nextronresearch with 9 thor detection hit. bazaar.abuse.ch/sample/33c017a… URL: hxxp://144.31.0(.)44/dynatrc.php
1
3
6
1
751
0
0
1
0
696
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Oct 22

#netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500

JAMESWT_WT's tweet image. #netsupport #rat Client32.ini MD5 7a9adb61e63b59a6a94ba289082ccfdd GatewayAddress=5.181.156.]153:443 Samples👇 bazaar.abuse.ch/browse/tag/5-1… @500mk500
1
3
26
3
2K
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Oct 22

🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport

NetSupport_Corp's tweet image. 🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport
0
0
0
0
5
NetSupportICorp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportInc
NetSupport-Inc Corp
 @NetSupportICorp
Oct 22

🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport

NetSupportICorp's tweet image. 🚨 Stop losing critical alerts in email! NetSupport Notify delivers instant, full-screen messages to every user. Speed up your crisis comms. Learn more: buff.ly/JcACnlG #MassNotification #ITAlerts #NetSupport
0
0
0
0
4
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 21

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
32
14K
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Oct 17

What a week! We had an absolutely amazing time connecting with everyone at GITEX GLOBAL 2025. Thank you to all the attendees and partners who stopped by our stand! 👋 Check out our upcoming events buff.ly/LIZ2lR6 #NetSupport #GITEX #EventWrapUp #ThankYou #UntilNextTime

0
0
0
0
15
NetSupportICorp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportInc
NetSupport-Inc Corp
 @NetSupportICorp
Oct 17

Can you see your wasted IT spending? NetSupport DNA can. 👀 Identify unused licenses, under-utilized hardware, and wasted energy to maximize ROI for your business. Learn more: buff.ly/94BBxR1 #ITAssetManagement #NetSupport #ITBudgets

NetSupportICorp's tweet image. Can you see your wasted IT spending? NetSupport DNA can. 👀 Identify unused licenses, under-utilized hardware, and wasted energy to maximize ROI for your business. Learn more: buff.ly/94BBxR1 #ITAssetManagement #NetSupport #ITBudgets
0
0
0
0
11
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Oct 15

Say 'hi' to our brilliant partner, @SYSTECHTECHNOCR, at @GITEX_GLOBAL! 👋 📍 Find us on Stand H4A-20 #NetSupport #Systech #PartnerPower #GITEX #DubaiWorldTradeCentre

NetSupport_Corp's tweet image. Say 'hi' to our brilliant partner, @SYSTECHTECHNOCR, at @GITEX_GLOBAL! 👋 📍 Find us on Stand H4A-20 #NetSupport #Systech #PartnerPower #GITEX #DubaiWorldTradeCentre
0
0
0
0
20
NetSupportNSM's profile picture. Leading the way in remote PC management for 33 years, NetSupport Manager is the award-winning multi-platform remote control solution from @NetSupport_Corp
NetSupport Manager
 @NetSupportNSM
Oct 14

We're live at GITEX GLOBAL 2025 and ready to show you the power of secure remote control. 🚀 Stop by our stand for a live demo of NetSupport Manager and see how you can get fast, secure remote control over any device. 📍 Find the team at Stand H4A-20. #NetSupport #GITEXGLOBAL

NetSupportNSM's tweet image. We're live at GITEX GLOBAL 2025 and ready to show you the power of secure remote control. 🚀 Stop by our stand for a live demo of NetSupport Manager and see how you can get fast, secure remote control over any device. 📍 Find the team at Stand H4A-20. #NetSupport #GITEXGLOBAL
0
0
0
0
24
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Oct 13

Come and see the NetSupport team for an exclusive demo of our latest solutions and score some awesome freebies! Stop by our stand to say hello! 👋 Learn more about the event: gitex.com #NetSupport #GITEX #TechEvent #FutureTech #Freebies #GITEX2025 @GITEX_GLOBAL

NetSupport_Corp's tweet image. Come and see the NetSupport team for an exclusive demo of our latest solutions and score some awesome freebies! Stop by our stand to say hello! 👋 Learn more about the event: gitex.com #NetSupport #GITEX #TechEvent #FutureTech #Freebies #GITEX2025 @GITEX_GLOBAL
0
0
0
0
36
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Oct 8

#netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2

JAMESWT_WT's tweet image. #netsupport #rat Samples Collection updated / tagged Client32.ini (MD5) 619d70ce84063c8e7e0817cb68e00bad 176.124.203.76:443 Client32.ini (MD5) a04a1940b7b97dc88f0d6aadab4cb095 basketballast.]com:443 blueprintsfdskjhfd.]com:443 62.164.177.48:443 1/2
1
6
21
0
2K
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Sep 29

'@GITEX_GLOBAL 2025 is coming! We're excited to be part of the world’s largest tech show to showcase our award-winning software solutions! ✅ Remote control ✅ITAM ✅Alerting and notification ✅Training and onboarding ✅Classroom management #GITEXGLOBAL #NetSupport #TechNews

NetSupport_Corp's tweet image. '@GITEX_GLOBAL 2025 is coming! We're excited to be part of the world’s largest tech show to showcase our award-winning software solutions! ✅ Remote control ✅ITAM ✅Alerting and notification ✅Training and onboarding ✅Classroom management #GITEXGLOBAL #NetSupport #TechNews
0
0
0
0
38
NetSupportICorp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportInc
NetSupport-Inc Corp
 @NetSupportICorp
Sep 23

It's time to ditch the loyalty tax! Check out our modern, secure and feature-rich tools with flexible pricing and free training. buff.ly/rC6Onh9 #SoftwareSolutions #ITPros #NetSupport

0
0
0
0
11
NetSupport_Corp's profile picture. Award-winning IT solutions for businesses and schools worldwide. For education solutions: @NetSupportGroup
NetSupport Corp
 @NetSupport_Corp
Sep 23

It's time to ditch the loyalty tax! Check out our modern, secure and feature-rich tools with flexible pricing and free training. buff.ly/rC6Onh9 #SoftwareSolutions #ITPros #NetSupport

0
0
0
0
13
NetSupportNSM's profile picture. Leading the way in remote PC management for 33 years, NetSupport Manager is the award-winning multi-platform remote control solution from @NetSupport_Corp
NetSupport Manager
 @NetSupportNSM
Sep 23

It's time to ditch the loyalty tax! Check out our modern, secure and feature-rich tools with flexible pricing and free training. buff.ly/rC6Onh9 #SoftwareSolutions #ITPros #NetSupport

0
0
0
0
20
NetSupport_de's profile picture. Der Himmel ist die Grenze... Preisgekrönte IT-Lösungen für Schulen und Unternehmen.
NetSupport GmbH (ehemals PCI Software GmbH)
 @NetSupport_de
Sep 23

Es ist Zeit, die Loyalitätssteuer abzuschaffen! Entdecken Sie unsere modernen, sicheren und funktionsreichen Tools mit flexiblen Preisen und kostenlosen Schulungen. buff.ly/rC6Onh9 #SoftwareLösungen #ITProfis #NetSupport

NetSupport_de's tweet image. Es ist Zeit, die Loyalitätssteuer abzuschaffen! Entdecken Sie unsere modernen, sicheren und funktionsreichen Tools mit flexiblen Preisen und kostenlosen Schulungen. buff.ly/rC6Onh9 #SoftwareLösungen #ITProfis #NetSupport
0
0
0
0
10
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Sep 19

#netsupport #rat client32.ini MD5 15d827801ccc1c544cbcd6ddf737d19f stenslie.]com:3085 itnblog.]com:3085 MD5 daa0f1d6b1856657445c4d0261db38fd 45.88.104.]5:443 MD5 a7ac424709447b46683d018ba7dac685 95.179.154.]161:443 1/2 cc @500mk500

JAMESWT_WT's tweet image. #netsupport #rat client32.ini MD5 15d827801ccc1c544cbcd6ddf737d19f stenslie.]com:3085 itnblog.]com:3085 MD5 daa0f1d6b1856657445c4d0261db38fd 45.88.104.]5:443 MD5 a7ac424709447b46683d018ba7dac685 95.179.154.]161:443 1/2 cc @500mk500
1
3
9
2
3K
Kostastsale's profile picture. No longer active here – find me on Bluesky: https://t.co/qHzDSxCjq8. 🇬🇷🇨🇦
Kostas
 @Kostastsale
Aug 10, 2023

Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…

Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
Kostastsale's tweet image. Interesting #FakeSG execution from an HTA payload that leads to #NetSupport. Find my SIGMA rule for detecting this cool cmstp.exe execution technique below: ➡️Lots of initial PowerShell obfuscated scripts ➡️Using cmstp.exe to install a fake connection manager service profile…
2
43
104
29
21K
James_inthe_box's profile picture.
James
 @James_inthe_box
Jan 22

#webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA

James_inthe_box's tweet image. #webshell #opendir #netsupport #rat at: https://appointedtimeagriculture\.com/wp-includes/blocks/post-content/ GatewayAddress=95.179.158.213:443 RADIUSSecret=dgAAAPpMkI7ke494fKEQRUoablcA
2
7
27
8
4K
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 24

New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…

YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
YungBinary's tweet image. New blog on #NetSupport RAT: a year's worth of incidents, identified 3 threat groups using it maliciously, and created an unpacking tool for PowerShell-based loader variants! esentire.com/blog/unpacking…
3
17
68
22
11K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Sep 29, 2023

This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…

1ZRR4H's tweet image. This obfuscation was crazy 🤩 I found it in some .bat files used to infect with #NetSupport RAT in July (#HANEYMANEY/#ZPHP distribution), C2: 5.252.178.48. Does anyone know what this type of obfuscation is called? 🧐 I shared the samples on Bazaar, for anyone who wants to dig…
11
40
186
62
63K
YungBinary's profile picture. Reverse Engineering, Detection Engineering, and Malware Research @eSentire
YungBinary
@YungBinary
Oct 21

Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…

YungBinary's tweet image. Seeing new #NetSupport campaigns that use a new PowerShell-based loader that drops/executes NetSupport and deletes RunMRU registry values in order to hide evidence of #ClickFix execution! This one has a licensee named KAKAN, though is likely related to EVALUSION campaigns. C2:…
1
21
112
32
14K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Dec 2, 2023

🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…

1ZRR4H's tweet image. 🚩 "svcservice.exe": bazaar.abuse.ch/sample/0fdc3d4…. Next stages: hxxp://andater393[.]net/see1.zip hxxp://andater393[.]net/see2.zip hxxp://andater393[.]net/see3.zip #NetSupport RAT C2: svanaten1[.]com:1061 svanaten2[.]com:1061 licensee=DERRJON34 serial_no=NSM186593 [+]…
0
18
62
9
19K
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Jan 30, 2023

Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm

1ZRR4H's tweet image. Thanks for sharing! #PureCrypter leads to #NetSupport RAT - 1st stage from: /centredesoinsanj.test-sites.fr/wp-admin/images/css/hills/bo/Zbstsgyoyuo.bmp (+#opendir) - 2nd stage from: /github.com/BotTradingg/loader/releases NetSupport C2: http://176.124.216.31/fakeurl.htm
5
9
26
4
13K
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Jul 21

5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT

skocherhan's tweet image. 5[.]181[.]157[.]34 AS39798 MivoCloud SRL 🇲🇩 #NetSupport @JAMESWT_WT
0
1
2
0
248
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Apr 5, 2024

🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…

1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1ZRR4H's tweet image. 🚩 #404TDS → #NetSupport RAT (seen 10 days ago, link still active). 1.- https://accesstobenefits[.]com/cjb1z ↩️ 2.- https://ziahasanexposed[.]com/temp/Update_Accounting_billing_details_dtd_0026032024_pdf.zip NetSupport C2: dcnlaleanae8[.]com:3120 dcnlaleanae9[.]com:3120 +…
1
8
46
8
4K
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Sep 8

43[.]218[.]76[.]102:790 #NetSupport

skocherhan's tweet image. 43[.]218[.]76[.]102:790 #NetSupport
0
0
2
0
1K
g0njxa's profile picture. ChatGPT says I'm a cyber researcher :) | donate 💸 to g0njxa.eth 💖 | Bad student, enthusiast, defo not an expert DMs are open, feel free to reach! 😼☂️🟣
Who said what?
@g0njxa
Oct 22, 2024

#ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…

g0njxa's tweet image. #ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…
g0njxa's tweet image. #ClickFix campaign targeting web3 users on YouTube sponsored videos spreading #Netsupport RAT Malicious paste: /pastesnip.com/raw/sNu60aPq Video: //www.youtube.com/watch?v=Qabajxy0OKY Detonation: app.any.run/tasks/f993b425…
2
10
30
9
3K
AndySvints's profile picture. CTO @exelegent, #IT Enthusiast, #PowerShell Toolmaker, Lovely #husband & #father; opinions are my own
Andy Svintsitsky
@AndySvints
Feb 2, 2024

#SmartApeSG Delivering #NetSupport #RAT by @esthreat •malicious #PowerShell script exec traced to end-user visiting compromised webpage which served a fake browser update #ZIP containing Update_browser_17.6436.js buff.ly/3u7rtbi #Malware #Research #AndySvints #InfoSec

AndySvints's tweet image. #SmartApeSG Delivering #NetSupport #RAT by @esthreat •malicious #PowerShell script exec traced to end-user visiting compromised webpage which served a fake browser update #ZIP containing Update_browser_17.6436.js buff.ly/3u7rtbi #Malware #Research #AndySvints #InfoSec
AndySvints's tweet image. #SmartApeSG Delivering #NetSupport #RAT by @esthreat •malicious #PowerShell script exec traced to end-user visiting compromised webpage which served a fake browser update #ZIP containing Update_browser_17.6436.js buff.ly/3u7rtbi #Malware #Research #AndySvints #InfoSec
0
0
0
0
186
smica83's profile picture. Threat Intel Specialist and Incident Responder. Private account. All opinions expressed here are mine only. https://t.co/7dQQO1JwUd
Szabolcs Schmidt
@smica83
Aug 6

'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)

smica83's tweet image. 'BL3.ps1' looks like #NetSupport @abuse_ch bazaar.abuse.ch/sample/446e471… 193.143.1(.)216:443 (Proton66)
2
4
15
1
742
1ZRR4H's profile picture. 🏴‍☠️ OFFENSIVE-INTEL 🏴‍☠️ Cyber Threat Intelligence by Hackers | Security Researcher en https://t.co/rDrSxZASB3 | @CuratedIntel Member | 🥷🧠🇨🇱
Germán Fernández
@1ZRR4H
Jan 24, 2024

Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…

1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
1ZRR4H's tweet image. Compromised site blawx[.]com downloads Javascript file BILL47189.js (bazaar.abuse.ch/sample/a95fe0e…) which eventually leads to #Netsupport RAT. "Exclusive Insights: Unveiling 2024's Lucrative Payouts!" Next stages: - https://blawx[.]com/letter.php?36393 -…
2
17
39
7
6K
g0njxa's profile picture. ChatGPT says I'm a cyber researcher :) | donate 💸 to g0njxa.eth 💖 | Bad student, enthusiast, defo not an expert DMs are open, feel free to reach! 😼☂️🟣
Who said what?
@g0njxa
Nov 27

A brief example analysis of the malware spread over SEO Poisoning, delivering #Lumma Stealer and #NetSupport targeting hard crypto wallets Thread👇👇

g0njxa's tweet image. A brief example analysis of the malware spread over SEO Poisoning, delivering #Lumma Stealer and #NetSupport targeting hard crypto wallets Thread👇👇
2
22
58
15
8K
skocherhan's profile picture. Digital nomad, exploring the cyber frontier.
ܛܔܔܔܛܔܛܔܛ
@skocherhan
Aug 11

144[.]172[.]104[.]121 AS14956 ROUTERHOSTING 🇺🇸 #NetSupport

skocherhan's tweet image. 144[.]172[.]104[.]121 AS14956 ROUTERHOSTING 🇺🇸 #NetSupport
0
0
0
0
192
JAMESWT_WT's profile picture. #Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
 @JAMESWT_WT
Sep 17

#NetSupport #Rat Samples Collection Updated/Tagged 👇 bazaar.abuse.ch/browse/signatu…

JAMESWT_WT's tweet image. #NetSupport #Rat Samples Collection Updated/Tagged 👇 bazaar.abuse.ch/browse/signatu…
1
0
8
0
836
doc_guard's profile picture. Analyze Malwares in seconds!
DOCGuard - Detect Maldocs in Seconds!
 @doc_guard
Jan 23, 2024

🚨 Malicious Javascript File Evaded Most of the AV Solutions #NetSupport🚨 📌 VT Detection: 3 / 58 📁 Filename: Update_browser_17.6436.js 🔐 MD5: 1c2732211585c64719d576f600937215 🕵️‍♂️ IOCs: phinetik[.]com DOCGuard Report: app.docguard.io/878cd20bb0e499…

doc_guard's tweet image. 🚨 Malicious Javascript File Evaded Most of the AV Solutions #NetSupport🚨 📌 VT Detection: 3 / 58 📁 Filename: Update_browser_17.6436.js 🔐 MD5: 1c2732211585c64719d576f600937215 🕵️‍♂️ IOCs: phinetik[.]com DOCGuard Report: app.docguard.io/878cd20bb0e499…
doc_guard's tweet image. 🚨 Malicious Javascript File Evaded Most of the AV Solutions #NetSupport🚨 📌 VT Detection: 3 / 58 📁 Filename: Update_browser_17.6436.js 🔐 MD5: 1c2732211585c64719d576f600937215 🕵️‍♂️ IOCs: phinetik[.]com DOCGuard Report: app.docguard.io/878cd20bb0e499…
doc_guard's tweet image. 🚨 Malicious Javascript File Evaded Most of the AV Solutions #NetSupport🚨 📌 VT Detection: 3 / 58 📁 Filename: Update_browser_17.6436.js 🔐 MD5: 1c2732211585c64719d576f600937215 🕵️‍♂️ IOCs: phinetik[.]com DOCGuard Report: app.docguard.io/878cd20bb0e499…
doc_guard's tweet image. 🚨 Malicious Javascript File Evaded Most of the AV Solutions #NetSupport🚨 📌 VT Detection: 3 / 58 📁 Filename: Update_browser_17.6436.js 🔐 MD5: 1c2732211585c64719d576f600937215 🕵️‍♂️ IOCs: phinetik[.]com DOCGuard Report: app.docguard.io/878cd20bb0e499…
0
13
41
6
3K

Something went wrong.


Something went wrong.


United States Trends