Insikt Group uncovered new infrastructure and infection methods employed by GrayAlpha, a cybercriminal group overlapping with FIN7, including custom loaders PowerNet and MaskBat leading to NetSupport RAT infections. The report highlights three primary infection vectors and emphasizes the importance of application allow-lists, employee training, and updated detection rules to combat these threats. #GrayAlpha #FIN7 #NetSupportRAT #PowerNet #MaskBat
Keypoints
- Insikt Group identified new domains and IP addresses linked to GrayAlpha, associated with payload distribution and malicious infrastructure.
- Two custom PowerShell loaders, PowerNet and MaskBat (an obfuscated variant related to FakeBat), were discovered, both facilitating NetSupport RAT deployment.
- Three main infection vectors were found: fake browser update pages, fake 7-Zip download sites, and the previously undocumented TAG-124 traffic distribution system (TDS).
- Only fake 7-Zip download pages remained active as of April 2025, with new domains still being registered.
- GrayAlpha overlaps with FIN7, a financially motivated and highly organized cybercriminal group active since 2013, known for sophisticated attacks on retail, hospitality, and financial sectors.
- FIN7 employs multiple custom malware tools including Carbanak backdoor, POWERTRASH loader, AuKill EDR evasion utility, and recently, a Python-based Anubis backdoor and ransomware-as-a-service partnerships.
- Most Infection Vector 1 domains are hosted by bulletproof hosting providers such as Stark Industries Solutions (AS44477) and FORTIS-AS (AS41745), linked to GrayAlpha and FIN7 activities.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – PowerShell loaders PowerNet and MaskBat used to decompress and execute NetSupport RAT (“custom PowerShell loader named PowerNet… MaskBat… obfuscated and contains strings linked to GrayAlpha”).
- [T1105] Ingress Tool Transfer – Use of fake download pages (7-Zip impersonation and fake browser updates) to distribute payloads (“fake browser update pages, fake 7-Zip download sites, and the traffic distribution system TAG-124”).
- [T1566] Phishing – Employment of spearphishing emails with malicious attachments and links to gain initial access (“FIN7 typically gains initial access through spearphishing emails containing malicious attachments or links”).
Indicators of Compromise
- [Domains] Infection vector domains impersonating legitimate services – aimp[.]xyz, concur[.]life, lexisnexis[.]pro, advanced-ip-scanner[.]link, sapconcur[.]top, meet-go[.]info, among others listed in Table 1.
- [IP Addresses] Hosting infrastructure used by GrayAlpha – 138[.]124[.]183[.]176 (AS44477), 86[.]104[.]72[.]23 (AS44477), 103[.]35[.]191[.]222 (AS44477), 45[.]89[.]53[.]243 (AS44477), and 91[.]228[.]10[.]81 (AS44477).
- [ASN] Bulletproof hosting providers supporting GrayAlpha infrastructure – AS44477 (Stark Industries Solutions), AS41745 (FORTIS-AS), AS29802 (HIVELOCITY, Inc.).
Views: 43