IOCs by window
0
IOCs tagged #NetSupportRAT
0
IOCs tagged #NetSupportRAT
0
IOCs tagged #NetSupportRAT
43
IOCs tagged #NetSupportRAT
Counts as of 2026-10-28. Regenerated daily.
About #NetSupportRAT
- Type: Legitimate remote-admin tool by NetSupport Ltd, used by attackers.
- Cover: Common in education and IT support, which helps it blend in.
- Delivery: SocGholish-style fake browser updates, malvertising, trojanised installers.
- Control: Full screen, file, process and registry control.
- Signals:
client32.exe,presentationsettings.exe,nsm.licin unusual user-profile paths. - References: MITRE ATT&CK S0480 · Malpedia
Recent IOCs tagged #NetSupportRAT
No IOCs tagged #NetSupportRAT in the past 30 days. Year total: 43. Older data: api.tweetfeed.live/v1/year (all tags, filter for #NetSupportRAT).
Related tags
Frequently asked questions
What is NetSupport RAT?
The research name for attackers abusing NetSupport Manager, a legitimate remote-admin tool. MITRE ATT&CK tracks it as S0480.
How does NetSupport RAT typically arrive on a victim system?
Mostly via SocGholish-style fake browser-update lures, malvertising and trojanised installers. The operator then gets full screen, file, process and registry control.
How is this list updated?
The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.
What is the license? Can I use this commercially?
Yes. All IOC data, including this NetSupport RAT subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.
License
NetSupport RAT IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.