GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

Insikt Group links new infrastructure and custom loaders (PowerNet and MaskBat) to GrayAlpha — an operator overlapping FIN7 — which deploys NetSupport RAT via fake browser-update pages, malicious 7‑Zip download sites, and the previously undocumented TAG‑124 TDS; the report provides domains, IPs, ASN/hosting attribution, historical context of FIN7 activity, and mitigation guidance including allow‑listing, detection rules, and monitoring.