Horns&Hooves campaign delivers NetSupport RAT and BurnsRAT
ID: 8c80aa87-044e-539f-96e9-250b4fda653f
STIX ID: report--8c80aa87-044e-539f-96e9-250b4fda653f
Feed Name: Securelist by Kaspersky
Threat Score
### Executive summary This report analyzes the Horns&Hooves email campaign (Mar 2023–Sep 2024) that used ZIP attachments with JS/HTA scripts to deploy NetSupport RAT and, earlier, BurnsRAT/RMS; it documents multiple delivery variants, infection chains, decoys, file hashes, C2 domains, and configuration artifacts, and attributes the campaign with high confidence to TA569 based on matching NetSupport configuration and license data.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.