Full Report
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims' browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called DeviceManager. "The first stage drops a steganographic PNG image into the browser's cache, retrieves its hidden content, and executes the second
Analysis Summary
This summary analyzes the reported activities of the DOUBLECUP Loader-as-a-Service (LaaS) and its associated payloads based on the technical details provided.
# Tool/Technique: DOUBLECUP (Loader-as-a-Service)
## Overview
DOUBLECUP is a Russian-origin Loader-as-a-Service (LaaS) utilized by threat actors to deliver various malware payloads. It primarily employs "ClickFix" social engineering lures—impersonating browser updates or software fixes—to trick users into executing malicious commands. A defining feature is its use of steganography to hide malicious code within PNG images stored in the browser's cache.
## Technical Details
- **Type:** Malware Family / Loader-as-a-Service (LaaS)
- **Platform:** Windows, macOS
- **Capabilities:** Steganographic payload delivery, environment-keying, multi-browser targeting, social engineering (ClickFix).
- **First Seen:** June 2026 (Assessed activity)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- [T1059.005 - Command and Scripting Interpreter: Visual Basic]
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1027.003 - Obfuscation: Steganography]
- [T1480.001 - Facilitate Operation: Environmental Keying]
- **[TA0011 - Command and Control]**
- [T1071.004 - Application Layer Protocol: DNS]
- [T1572 - Protocol Tunneling]
## Functionality
### Core Capabilities
- **ClickFix Lures:** Prompts users to copy and run a command (via PowerShell or CMD) under the guise of fixing a browser error.
- **Cached Steganography:** Drops a PNG image into the victim's browser cache. The loader later retrieves this image to extract hidden malicious stages.
- **Payload Delivery:** Facilitates the deployment of **CountLoader** and the **DeviceManager** RAT.
### Advanced Features
- **Environmental Keying:** Decrypts second-stage payloads using the victim's public IP address as a cryptographic seed, preventing execution or analysis in sandbox environments.
- **EtherHiding:** Uses blockchain-based techniques (specifically via smart contracts or transaction data) to resolve C2 infrastructure addresses, making the backend difficult to take down.
- **Broadcaster Pane:** A Go-based Windows GUI allowing operators to manage licenses, build payloads, and issue direct commands to infected hosts.
## Indicators of Compromise
*Note: Indicators are based on the provided report.*
- **Network Indicators:**
- `213.139.77[.]109:9090` (License Panel/Open Directory)
- `harrypoterlohBOT` (Telegram Bot)
- **File Names/Contexts:**
- `Agent IDE` (Malicious VS Code Extension)
- **Behavioral Indicators:**
- Unexpected PowerShell or VBScript execution triggered by clipboard actions.
- Large numbers of PNG files being written to and read from browser cache directories in rapid succession.
- DNS tunneling traffic (unusually high volume of DNS TXT or sub-domain queries).
## Associated Threat Actors
- **"johnnysilverhe"**: Identified as the developer/manager of the Telegram infrastructure and a malicious VS Code extension linked to the operation.
- **General Cybercrime:** Russian-speaking threat actors utilizing the LaaS model.
## Detection Methods
- **Behavioral Detection:** Monitor for "ClickFix" patterns—specifically processes like `powershell.exe` or `cmd.exe` being launched where the parent process is a web browser and the command line contains strings related to clipboard content or cache manipulation.
- **File Integrity:** Inspect browser cache for unusual PNG files that fail standard image validation or contain high entropy (indicative of encrypted data).
- **Network Monitoring:** Alert on DNS tunneling signatures and connections to known Telegram Bot API endpoints originating from non-standard user processes.
## Mitigation Strategies
- **User Education:** Train staff to never copy and paste commands from a website directly into a terminal (PowerShell/CMD), regardless of the site's apparent legitimacy.
- **Attack Surface Reduction:** Implement PowerShell Constrained Language Mode and restrict the execution of unsigned scripts.
- **Endpoint Security:** Use EDR solutions to block unauthorized script execution and monitor for environmental keying attempts (e.g., processes querying public IP discovery services followed by decryption routines).
- **Extension Management:** Restrict the installation of browser and IDE extensions (like VS Code) to a pre-approved allowlist.
## Related Tools/Techniques
- **ClickFix:** The social engineering framework used to initiate the infection.
- **CountLoader:** A multi-platform loader often delivered by DOUBLECUP.
- **DeviceManager:** A specialized RAT that utilizes DNS tunneling and EtherHiding.