ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager
Cisco Talos details ClearFake WebDAV chains delivering Amatera stealer to a Ukrainian government organization, with cryptocurrency and credential theft payloads.
Cisco Talos investigated DLL executions named 'verification.google' via WebDAV UNC paths at a Ukrainian government organization, tracking the actor as UAT-10820 and assessing with moderate confidence the activity is Russian and opportunistic rather than targeted. The infection chain uses ClearFake JavaScript injected via a Cloudflare Worker, EtherHiding storage on BNB Smart Chain contracts, and a ClickFix fake Google CAPTCHA prompt to deliver Amatera stealer. Secondary payloads differ by C2: one loader deploys ZigCryptoStealer with a Go reverse TCP proxy and a vulnerable driver that kills EDR, while the other installs an unauthorized NetSupport Manager with a Russia-based C2. Similar Amatera chains were separately documented by Malwarebytes and Blackpoint Cyber, but with no shared infrastructure.
- WebDAV DLL execution observed in April 2026 at a Ukrainian government organization
- EtherHiding stores JavaScript in BNB Smart Chain contracts served via Cloudflare Worker
- ClickFix fake Google CAPTCHA prompt leads to Amatera stealer download
- ZigCryptoStealer branch uses a vulnerable driver to terminate EDR software
- Actor tracked as UAT-10820, moderately assessed as Russian
- Vendors
- Cisco TalosNetSupport
- Products
- NetSupport Manager
- Threat actors
- UAT-10820
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bsc.rpc.blxrbdn.com | ad. The payload makes a separate JSON-RPC eth_call through "bsc[.]rpc[.]blxrbdn[.]com" to BNB Smart Chain contract 0x7CC3cFC1Ac007B8c6566fD |
| domain | bsc-testnet-rpc.publicnode.com | ontract 0x886d310Ac23e05EA705e24E513D19f53793832A9 through "bsc-testnet-rpc[.]publicnode[.]com". BNB Smart Chain is a public, Ethereum-compatible bloc |
| domain | fd.gstats-api-contact.cc | ly: Effective period in UTC Contract value June 30 – July 5 fd[.]gstats-api-contact[.]cc July 5 – 9 pkg[.]vogueatelier[.]cc July 9 – 12 kffd3[.] |
| domain | kffd3.vexlatech.cc | ier[.]cc July 9 – 12 kffd3[.]vogueatelier[.]cc July 12 – 18 kffd3[.]vexlatech[.]cc July 18 – 26 static[.]quorashift[.]cc July 26 – 30 lb[. |
| domain | kffd3.vogueatelier.cc | contact[.]cc July 5 – 9 pkg[.]vogueatelier[.]cc July 9 – 12 kffd3[.]vogueatelier[.]cc July 12 – 18 kffd3[.]vexlatech[.]cc July 18 – 26 static |
| domain | lb.propertyfind.cc | ring) function. During our analysis, the contract returned "lb[.]propertyfind[.]cc", which ZigCryptoStealer then used as its C2 domain. Th |
| domain | leaguejazire.com | d command opens a WebDAV path on a randomized subdomain of "leaguejazire[.]com", places the victim identifier in the path, and executes |
| domain | pkg.vogueatelier.cc | ue June 30 – July 5 fd[.]gstats-api-contact[.]cc July 5 – 9 pkg[.]vogueatelier[.]cc July 9 – 12 kffd3[.]vogueatelier[.]cc July 12 – 18 kffd |
| domain | riyazinikokar.xyz | acOS user-agent string. The request goes to a subdomain of "riyazinikokar[.]xyz". Since the subject of our initial research was a custome |
| domain | static.quorashift.cc | elier[.]cc July 12 – 18 kffd3[.]vexlatech[.]cc July 18 – 26 static[.]quorashift[.]cc July 26 – 30 lb[.]propertyfind[.]cc Talos used Cisco Um |
| domain | telegra.ph | n "pf.ch" branch constructs the dead drop C2 URL "https[:]//telegra[.]ph/Functions-04-03". At the time of analysis, the page looke |
| ipv4 | 145.249.109.147 | d by the payload. Decoding MTQ1LjI0OS4xMDkuMTQ3 produces “145.249.109[.]147” as its C2 address. After resolving the address, the payl |
| ipv4 | 45.150.34.2 | ncrypted string. At runtime, it decrypts the fixed address "45.150.34[.]2" and connects to it directly on TCP port 443, while prese |
| sha256 | 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92 | most recently observed response was a ZIP archive, SHA-256 279d04c0cfd700c8bcb9acbed528131d3ffef8e25d12713e8649772739aecb92. The archive included the file "platform_experience_helper. |
From the original article
13 min read at blog.talosintelligence.com
We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and credentials-stealing operation using the Amatera stealer as the primary payload.
By Vanja Svajcer · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.