Full Report
ClickFix infection deploys Matanbuchus 3.0 loader and drops a new RAT that we’ve dubbed AstarionRAT. We break down the layers and the hands-on intrusion that followed.
Analysis Summary
# Incident Report: ClickFix Infection Leading to Matanbuchus 3.0 and AstarionRAT
## Executive Summary
In February 2026, a hands-on-keyboard intrusion occurred following a ClickFix social engineering attack that deployed the Matanbuchus 3.0 loader. The attack introduced a previously undocumented custom implant, AstarionRAT, and escalated to rapid lateral movement targeting domain controllers. The incident was disrupted by security responders during the lateral movement phase, preventing potential ransomware deployment or large-scale data exfiltration.
## Incident Details
- **Discovery Date:** February 2026
- **Incident Date:** February 2026
- **Affected Organization:** Not disclosed
- **Sector:** Targeted mid-market (implied by Matanbuchus pricing/targeting)
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Day 1
- **Vector:** ClickFix (Social Engineering)
- **Details:** The victim was tricked into copying and pasting malicious commands into their system, bypassing email filters. This triggered a silent MSI installation that deployed Matanbuchus 3.0.
### Lateral Movement
- **Date/Time:** Day 2 (within a 40-minute window)
- **Details:** The threat actor returned and moved from the initial entry point to a Windows Server and two Domain Controllers. The actor utilized PsExec for movement and created rogue accounts for persistence.
### Data Exfiltration/Impact
- **Details:** While final objectives were disrupted, the actor staged Windows Defender exclusions and utilized a renamed 7-Zip utility, suggesting preparation for data staging and ransomware execution.
### Detection & Response
- **Discovery:** Detected by Huntress SOC during the hands-on-keyboard phase.
- **Response:** The operator was disrupted during lateral movement; containment and remediation were initiated before the final impact occurred.
## Attack Methodology
- **Initial Access:** ClickFix (user-executed PowerShell/Command prompts).
- **Persistence:** Matanbuchus 3.0 loader and rogue account creation on Domain Controllers.
- **Privilege Escalation:** Domain Controller compromise via administrative credentials/PsExec.
- **Defense Evasion:** DLL sideloading (Zillya Antivirus and Java binaries), ChaCha20 encryption for Matanbuchus traffic, RSA-encrypted C2 traffic disguised as application telemetry, and staging Defender exclusions.
- **Credential Access:** AstarionRAT's built-in credential theft modules.
- **Discovery:** Port scanning and network reconnaissance via AstarionRAT and native tools.
- **Lateral Movement:** PsExec.
- **Collection:** Staging via 7-Zip (renamed).
- **Exfiltration:** AstarionRAT SOCKS5 proxy and C2 channels.
- **Impact:** Preparation for ransomware (disrupted).
## Impact Assessment
- **Financial:** Prevented potential million-dollar ransomware demand; Matanbuchus 3.0 licensing costs for the attacker are estimated at $10k-$15k/month.
- **Data Breach:** Risk of credential theft; volume of exfiltrated data appears low due to early disruption.
- **Operational:** Minimal disruption due to rapid response, though Domain Controllers required remediation.
- **Reputational:** Low, as the incident was contained.
## Indicators of Compromise
- **Network:** RSA-encrypted traffic disguised as application telemetry (C2).
- **File:**
- `Matanbuchus 3.0` loader
- `AstarionRAT` (Custom implant)
- `Zillya Antivirus` DLLs (sideloaded)
- `java.exe` / `jli.dll` (sideloaded)
- `7-Zip` (renamed)
- **Behavioral:**
- Use of `C:\ProgramData\USO` for staging.
- PowerShell/CMD execution following browser-based "fix" prompts.
- Rapid lateral movement via PsExec shortly after infection.
## Response Actions
- **Containment:** Isolation of affected endpoints and Domain Controllers.
- **Eradication:** Removal of rogue accounts, Matanbuchus/AstarionRAT binaries, and clearing of Defender exclusions.
- **Recovery:** Restoration of secure configurations on Domain Controllers.
## Lessons Learned
- **Social Engineering Evolution:** ClickFix effectively bypasses technical email controls by moving the attack to the browser and local shell.
- **MaaS Sophistication:** The high cost of Matanbuchus 3.0 indicates that threat actors are willing to invest heavily in loaders that offer superior evasion and layered delivery.
- **Speed of Intrusion:** The transition from initial RAT deployment to Domain Controller compromise can occur in under an hour.
## Recommendations
- **User Education:** Train staff specifically on "ClickFix" style prompts (e.g., "Press Win+R, CTRL+V" browser pop-ups).
- **Technical Controls:** Restrict PsExec usage to authorized admin workstations only.
- **Endpoint Protection:** Monitor for DLL sideloading in legitimate binaries (like Java or Zillya) and audit Windows Defender exclusion lists for unauthorized changes.
- **Attack Surface Reduction:** Block execution of MSI files from Temp or ProgramData directories where possible.