{ "type": "Domain", "indicator": "incomputersolutions.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/incomputersolutions.com", "alexa": "http://www.alexa.com/siteinfo/incomputersolutions.com", "indicator": "incomputersolutions.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4016490101, "indicator": "incomputersolutions.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "6873f6e5476256d77731f7b0", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:58:15.144000", "created": "2025-07-13T18:11:49.578000", "tags": [ "netsupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 61, "FileHash-SHA256": 292, "URL": 273, "domain": 24, "hostname": 10 }, "indicator_count": 721, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6873ec10df69beb94f1020e2", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:57:13.653000", "created": "2025-07-13T17:25:36.494000", "tags": [ "netsupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 43, "FileHash-SHA256": 283, "URL": 233, "domain": 29, "hostname": 9 }, "indicator_count": 640, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "685f32cfd76f443646fa216c", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:56:43.575000", "created": "2025-06-28T00:09:51.241000", "tags": [ "NetSupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 60, "FileHash-SHA1": 60, "FileHash-SHA256": 306, "URL": 257, "domain": 25, "hostname": 6 }, "indicator_count": 714, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68501d4fdfff50ae08ac4c34", "name": "remcos", "description": "", "modified": "2026-01-15T23:40:23.717000", "created": "2025-06-16T13:34:07.900000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 59, "FileHash-SHA1": 59, "FileHash-SHA256": 247, "URL": 202, "domain": 16, "hostname": 4 }, "indicator_count": 587, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "687ef738d33157b867c196f0", "name": "NetSupport Rat", "description": "", "modified": "2025-08-21T02:03:06.609000", "created": "2025-07-22T02:28:08.003000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 55, "FileHash-SHA1": 55, "FileHash-SHA256": 283, "URL": 247, "domain": 32, "hostname": 11 }, "indicator_count": 683, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "284 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "672f6ed2b564f00b7c5cb13f", "name": "Threatfox Recent Additions", "description": "", "modified": "2025-06-13T19:00:02.811000", "created": "2024-11-09T14:16:50.032000", "tags": [], "references": [ "", "https://threatfox.abuse.ch/export/csv/recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 96, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 47587, "URL": 18714, "FileHash-SHA256": 36311, "FileHash-MD5": 1630, "FileHash-SHA1": 418, "hostname": 18190 }, "indicator_count": 122850, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ac545db98bda088419c061", "name": "NetSupport RAT Clickfix Distribution", "description": "", "modified": "2025-03-14T07:00:16.070000", "created": "2025-02-12T07:57:17.711000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "444 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67aa41b21da119558f9c89b3", "name": "Cybercriminals Weaponize NetSupport RAT via ClickFix Attacks", "description": "Cybersecurity researchers have noted a sharp rise in the use of the NetSupport Remote Access Trojan (RAT), a malicious tool enabling attackers to take full control of infected systems. This increase is tied to the \"ClickFix\" Initial Access Vector, a social engineering tactic that deceives users into running harmful PowerShell commands.", "modified": "2025-03-12T18:03:27.272000", "created": "2025-02-10T18:13:06.831000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Superpro", "id": "61676", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 214, "modified_text": "445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67aa15d0babbde0f71a259a9", "name": "eSentire | NetSupport RAT Clickfix Distribution", "description": "Beginning in early January 2025, eSentire Threat Response Unit (TRU) observed an increase in the number of incidents involving the NetSupport Remote Access Trojan (RAT). This activity remains common leading into early February. NetSupport RAT grants the attackers full control over the victim's host, allowing them to monitor the user's screen, control the keyboard and mouse, upload and download files, and launch and execute malicious commands. If left undetected, NetSupport RAT can lead to advanced threats, including ransomware attacks, compromising sensitive data, and disrupting business operations.", "modified": "2025-03-12T15:01:41.823000", "created": "2025-02-10T15:05:52.444000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "676b4cbc8bb492f5d7727f30", "name": "URLHaus data - 24-12-2024", "description": "", "modified": "2025-01-24T00:00:38.344000", "created": "2024-12-25T00:07:24.781000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "arm", "hajime", "SocGholish", "ddos", "sh", "dll", "Stealc", "bash", "CVE-2017-17215", "wget", "gafgyt", "exe", "opendir", "ua-wget", "donutloader", "AsyncRAT", "base64", "rev", "rev-base64-loader", "hta", "Emmenhtal", "FakeCaptcha", "FakeMP4", "LummaStealer", "NetSupport", "x86-32" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 6, "domain": 4 }, "indicator_count": 1010, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "493 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "https://urlhaus.abuse.ch/browse/", "https://threatfox.abuse.ch/export/csv/recent/", "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "6873f6e5476256d77731f7b0", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:58:15.144000", "created": "2025-07-13T18:11:49.578000", "tags": [ "netsupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 61, "FileHash-SHA256": 292, "URL": 273, "domain": 24, "hostname": 10 }, "indicator_count": 721, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6873ec10df69beb94f1020e2", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:57:13.653000", "created": "2025-07-13T17:25:36.494000", "tags": [ "netsupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 43, "FileHash-SHA256": 283, "URL": 233, "domain": 29, "hostname": 9 }, "indicator_count": 640, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "685f32cfd76f443646fa216c", "name": "NetSupport", "description": "", "modified": "2026-02-05T01:56:43.575000", "created": "2025-06-28T00:09:51.241000", "tags": [ "NetSupport" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 60, "FileHash-SHA1": 60, "FileHash-SHA256": 306, "URL": 257, "domain": 25, "hostname": 6 }, "indicator_count": 714, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "116 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68501d4fdfff50ae08ac4c34", "name": "remcos", "description": "", "modified": "2026-01-15T23:40:23.717000", "created": "2025-06-16T13:34:07.900000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 59, "FileHash-SHA1": 59, "FileHash-SHA256": 247, "URL": 202, "domain": 16, "hostname": 4 }, "indicator_count": 587, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "687ef738d33157b867c196f0", "name": "NetSupport Rat", "description": "", "modified": "2025-08-21T02:03:06.609000", "created": "2025-07-22T02:28:08.003000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 55, "FileHash-SHA1": 55, "FileHash-SHA256": 283, "URL": 247, "domain": 32, "hostname": 11 }, "indicator_count": 683, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "284 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "672f6ed2b564f00b7c5cb13f", "name": "Threatfox Recent Additions", "description": "", "modified": "2025-06-13T19:00:02.811000", "created": "2024-11-09T14:16:50.032000", "tags": [], "references": [ "", "https://threatfox.abuse.ch/export/csv/recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 96, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 47587, "URL": 18714, "FileHash-SHA256": 36311, "FileHash-MD5": 1630, "FileHash-SHA1": 418, "hostname": 18190 }, "indicator_count": 122850, "is_author": false, "is_subscribing": null, "subscriber_count": 144, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ac545db98bda088419c061", "name": "NetSupport RAT Clickfix Distribution", "description": "", "modified": "2025-03-14T07:00:16.070000", "created": "2025-02-12T07:57:17.711000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "444 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67aa41b21da119558f9c89b3", "name": "Cybercriminals Weaponize NetSupport RAT via ClickFix Attacks", "description": "Cybersecurity researchers have noted a sharp rise in the use of the NetSupport Remote Access Trojan (RAT), a malicious tool enabling attackers to take full control of infected systems. This increase is tied to the \"ClickFix\" Initial Access Vector, a social engineering tactic that deceives users into running harmful PowerShell commands.", "modified": "2025-03-12T18:03:27.272000", "created": "2025-02-10T18:13:06.831000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Superpro", "id": "61676", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 214, "modified_text": "445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67aa15d0babbde0f71a259a9", "name": "eSentire | NetSupport RAT Clickfix Distribution", "description": "Beginning in early January 2025, eSentire Threat Response Unit (TRU) observed an increase in the number of incidents involving the NetSupport Remote Access Trojan (RAT). This activity remains common leading into early February. NetSupport RAT grants the attackers full control over the victim's host, allowing them to monitor the user's screen, control the keyboard and mouse, upload and download files, and launch and execute malicious commands. If left undetected, NetSupport RAT can lead to advanced threats, including ransomware attacks, compromising sensitive data, and disrupting business operations.", "modified": "2025-03-12T15:01:41.823000", "created": "2025-02-10T15:05:52.444000", "tags": [ "netsupport rat", "clickfix", "access trojan", "source", "january", "threat response", "unit", "powershell", "network", "compromise", "february", "refer", "virustotal" ], "references": [ "https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "URL": 22, "domain": 9 }, "indicator_count": 37, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "676b4cbc8bb492f5d7727f30", "name": "URLHaus data - 24-12-2024", "description": "", "modified": "2025-01-24T00:00:38.344000", "created": "2024-12-25T00:07:24.781000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "arm", "hajime", "SocGholish", "ddos", "sh", "dll", "Stealc", "bash", "CVE-2017-17215", "wget", "gafgyt", "exe", "opendir", "ua-wget", "donutloader", "AsyncRAT", "base64", "rev", "rev-base64-loader", "hta", "Emmenhtal", "FakeCaptcha", "FakeMP4", "LummaStealer", "NetSupport", "x86-32" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 6, "domain": 4 }, "indicator_count": 1010, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "493 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "incomputersolutions.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "incomputersolutions.com", "found": true, "verdict": "malicious", "url_count": 13, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://incomputersolutions.com/o/9.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/1.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/7.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/4.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/10.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/8.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/11.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/o.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/5.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] }, { "url": "http://incomputersolutions.com/o/12.png", "status": "offline", "threat": "malware_download", "date_added": "2024-12-24", "tags": [ "NetSupport" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780315494.1152055 }