Clubfoot Wolf launches massive offensive on Russian businesses

To gain initial access, the attackers used phishing campaigns with NetSupport Manager, a legitimate remote monitoting and management tool

Tactic	Technique	Procedure
Resource Development	Acquire Infrastructure: Domains	Clubfoot Wolf registers .fun, .tech, and .com domains
	Acquire Infrastructure: Virtual Private Server	Rents virtual private servers to host its tools and NetSupport Manager C2 servers
	Develop Capabilities: Malware	Develops malicious LNK files and PowerShell scripts to deliver NetSupport Manager into target systems
	Establish Accounts: Email Accounts	Registers email accounts with Yandex Mail
	Obtain Capabilities: Tool	Uses the legitimate remote administration tool NetSupport Manager in attacks
	Stage Capabilities: Upload Malware	Hosts a malicious PowerShell script for in‑memory download and execution
	Stage Capabilities: Upload Tool	Hosts a ZIP archive with NetSupport Manager
	Stage Capabilities: Link Target	Uses URLCrop to shorten links
Initial Access	Phishing: Spearphishing Attachment	Distributes malware in ZIP attachments to phishing emails
Execution	Command and Scripting Interpreter: PowerShell	Uses malicious LNK files to execute a PowerShell command: `powershell.exe -E [base64_command] -W 1`
	User Execution: Malicious File	Initiates system compromise when the user opens the malicious LNK file delivered in the phishing email
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Uses a PowerShell script to add NetSupport Manager in the startup folder via the Run registry key: `[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] AudioStock = "%LOCALAPPDATA%\AudioStock\audiostock.exe"`
Stealth	Deobfuscate/Decode Files or Information	Uses PowerShell obfuscation techniques, including variable name randomization, string concatenation, and AES‑128‑CBC encryption of string constants followed by Base64 encoding
	Hide Artifacts: Hidden Window	Stealthily executes the PowerShell command when launching the LNK file, using the `-W (-WindowStyle)` parameter with a value of `1 (Hidden)`
	Masquerading	Disguises malicious LNK files as a purchase order: `Заявка на закупку от компании [название компании] на [год]г.lnk`
	Masquerading: Match Legitimate Resource Name or Location	Copies NetSupport Manager from the downloaded ZIP archives to a directory mimicking a legitimate software name: `%LOCALAPPDATA%\MediaManager\mediamanager.exe` Creates parameters in the Run registry key, mimicking those of trusted software: `[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] MediaManager = "%LOCALAPPDATA%\MediaManager\mediamanager.exe"`
	Obfuscated Files or Information	Obfuscates PowerShell scripts
	Obfuscated Files or Information: Command Obfuscation	Base64‑encodes PowerShell commands in LNK files
Command and Control	Application Layer Protocol: Web Protocols	Uses HTTP(S) to communicate with its network resources
	Encrypted Channel: Asymmetric Cryptography	Uses SSL/TLS encryption to communicate with its network resources
	Ingress Tool Transfer	Uses PowerShell scripts to download the next‑stage PowerShell script and the ZIP archive with NetSupport Manager
	Non‑Standard Port	Uses non‑standard ports 1411 and 1414 for NetSupport Manager control servers
	Remote Access Tools: Remote Desktop Software	Uses NetSupport Manager to control the compromised host
	Web Service	Uses the Yandex Disk cloud storage to host decoy PDF documents