Full Report
A ClickFix infection drops Potemkin loader and RMMProject RAT, leading to browser theft, hidden remote desktop, and lateral movement across over 11 hosts.
Analysis Summary
# Tool/Technique: ClickFix (leading to Potemkin & RMMProject)
## Overview
This attack involves the **ClickFix** social engineering technique used to deliver a novel loader named **Potemkin**, which subsequently deploys a sophisticated Remote Access Trojan (RAT) called **RMMProject**. The campaign is characterized by high levels of human-operated (hands-on-keyboard) activity, lateral movement to over 11 hosts, and persistence via **EtherRAT** and Cloudflare tunnels.
## Technical Details
- **Type:** Social Engineering (ClickFix) | Malware Family (Potemkin, RMMProject, EtherRAT) | Tool (Chisel, Cloudflare Tunnels)
- **Platform:** Windows (x64)
- **Capabilities:** Credential theft, browser cookie theft (bypassing Chrome App-Bound Encryption), hidden remote desktop control, lateral movement, and DGA-based C2 communication.
- **First Seen:** May 2026 (Reported June 2026)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1204.002 - User Execution: Malicious File] (ClickFix MSI execution)
- **[TA0003 - Persistence]**
- [T1543.003 - Create or Modify System Process: Windows Service]
- [T1572 - Protocol Tunneling] (Cloudflare Tunnels)
- **[TA0005 - Defense Evasion]**
- [T1620 - Reflective Code Loading] (Potemkin loading RMMProject)
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (Killing Windows Defender service)
- [T1027.005 - Indicator Removal from Tools: Indicator Blocking] (AMSI patching)
- **[TA0006 - Credential Access]**
- [T1555.003 - Credentials from Web Browsers] (Chrome, Edge, Firefox)
- **[TA0008 - Lateral Movement]**
- [T1021.002 - Remote Services: SMB/Windows Admin Shares] (SMBExec)
- [T1047 - Windows Management Instrumentation] (WMIExec)
- **[TA0011 - Command and Control]**
- [T1568.002 - Dynamic Resolution: Domain Generation Algorithms] (Deterministic DGA)
- [T1102.003 - Web Service: One-Way Communication] (Ethereum blockchain for EtherRAT C2)
## Functionality
### Core Capabilities
* **Potemkin Loader:** An x64 loader using a deterministic DGA and a custom byte cipher. Its primary function is the reflective loading of modules (specifically RMMProject) in memory.
* **RMMProject RAT:** A LuaJIT-scriptable DLL featuring 15 distinct task types for remote management and data exfiltration.
* **EtherRAT:** A Node.js-based backdoor that uses the Ethereum blockchain to resolve its C2 address, providing a resilient backup access channel.
### Advanced Features
* **Chrome App-Bound Encryption Bypass:** RMMProject uses embedded DLL injection into spawned browser processes to bypass modern Chrome security features and steal encrypted cookies/credentials.
* **Hidden Desktop:** A module allowing attackers remote control via a hidden desktop environment to avoid alerting the logged-in user.
* **Defense Neutralization:** Active hands-on-keyboard scripts to cycle through AMSI patches, registry policy modifications, and ultimately terminating the Windows Defender service.
## Indicators of Compromise
* **File Names:** `CrashFix`, `Potemkin`, `RMMProject` (often delivered via MSI packages).
* **Network Indicators:**
* C2 domains generated via DGA (Deterministic).
* `cloudflare-eth[.]com` (or similar Cloudflare tunnel endpoints).
* Ethereum blockchain transactions used for C2 resolution.
* **Behavioral Indicators:**
* Users executing `Win+R` followed by a PowerShell command string (ClickFix).
* `powershell.exe` or `cmd.exe` spawning from browser processes.
* Sudden termination of `MsMpEng.exe` (Windows Defender).
* Execution of `WMIExec.py` or `SMBExec` patterns for lateral movement.
## Associated Threat Actors
* **Vanilla Tempest** (Associated with similar delivery chains).
* **KongTuke** (Known for CrashFix/ClickFix campaigns).
## Detection Methods
* **Behavioral Detection:** Monitor for the "ClickFix" pattern: a user copying a script from a browser and pasting it directly into the `Run` prompt (`Win+R`).
* **Service Monitoring:** Alert on the unexpected disabling or service-stop commands directed at Windows Defender or other EDR agents.
* **Network Analysis:** Detect non-standard use of Cloudflare Tunnels (Chisel/Cloudflared) on endpoints that do not require them for business operations.
## Mitigation Strategies
* **User Training:** Educate users on the "ClickFix" social engineering tactic; emphasize that no legitimate support site will ask a user to copy-paste scripts into a `Run` prompt.
* **Endpoint Hardening:** Implement Attack Surface Reduction (ASR) rules to block process creations from Office/Browsers and restrict WMI/SMB lateral movement tools.
* **Visibility:** Ensure 100% endpoint coverage with EDR/MDR; this attack specifically targeted unmonitored hosts to gain its initial foothold.
## Related Tools/Techniques
* **Matanbuchus:** Often delivered via similar ClickFix chains.
* **AstarionRAT:** A previous custom implant seen in ClickFix infections.
* **Chisel:** Used for creating reverse SOCKS tunnels for lateral movement.