{
  "name": "Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack",
  "slug": "potemkin-loader-rmmproject-the-anatomy-of-a-clickfix-attack",
  "description": "A ClickFix social engineering attack on an unmonitored endpoint led to a multi-stage intrusion affecting over 11 hosts. The infection chain began with a malicious HTA payload that silently installed an MSI package containing Potemkin, a custom loader with a deterministic DGA. Potemkin delivered RMMProject, a 4.4 MB Lua-scriptable RAT featuring browser credential theft with Chrome App-Bound Encryption bypass, hidden-desktop remote control, and 15 distinct task types. The attacker deployed EtherRAT, a Node.js backdoor resolving C2 addresses from Ethereum blockchain, and established a Cloudflare tunnel for persistent access. Hands-on-keyboard activity included battling Windows Defender through AMSI patches, registry modifications, and service termination, followed by lateral movement via WMIExec and SMBExec to deploy malware across the network and reach the domain controller.",
  "published": "2026-06-16T14:27:51.719000+00:00",
  "created_at": "2026-06-16T17:19:17.807000+00:00",
  "modified_at": "2026-06-16T15:19:17+00:00",
  "created_at_opencti": "2026-06-16T17:19:17.807000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "blockchain c2",
    "chisel",
    "clickfix",
    "credential theft",
    "dga",
    "etherrat",
    "hidden desktop",
    "lateral movement",
    "potemkin",
    "rmmproject"
  ],
  "tags": [
    "2026-06-16",
    "blockchain c2",
    "chisel",
    "clickfix",
    "credential-theft",
    "dga",
    "etherrat",
    "hidden desktop",
    "lateral movement",
    "potemkin",
    "rmmproject"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "206781a6-28d9-4fd7-8408-acd7f0399a75",
        "name": "http://77.110.122.58:23205/cons_1.0.1.msi"
      },
      {
        "id": "7bf58b11-b9e6-402a-9035-f4bb99ed4315",
        "name": "3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce"
      },
      {
        "id": "ae05ab65-a282-4284-9ab1-716b714361d4",
        "name": "https://cl.distritovagas.com/hte.hta"
      },
      {
        "id": "248e0348-3c0c-4920-9e82-36d02197d4f7",
        "name": "2ada24dd6e517f37942b749c2bd57ddd97445e9853002cee70a0bc30d0b0ce3a"
      },
      {
        "id": "2cfa1feb-29c2-4168-800a-fa8f4e907890",
        "name": "cl.distritovagas.com"
      },
      {
        "id": "d67d7317-cd1a-4b74-af0b-e36189fa2f3f",
        "name": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe"
      },
      {
        "id": "c66349e5-f830-4159-8a1c-3f9b986b571b",
        "name": "2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b"
      },
      {
        "id": "6ea4fb1c-2636-44f9-beea-d4758cedf12d",
        "name": "http://77.110.122.58:44479/bjxxUmG8K3uy.ps1"
      },
      {
        "id": "fd55744c-f644-46b4-b9d3-348cabf54a96",
        "name": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe'"
      },
      {
        "id": "738917a9-3517-47b9-804b-37028a10366d",
        "name": "77.110.122.58"
      },
      {
        "id": "586204e3-25af-4c09-929a-2c30572a85ce",
        "name": "resumeacceptable.com"
      },
      {
        "id": "af936035-2915-4f4a-93fa-f761844d5821",
        "name": "cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145"
      },
      {
        "id": "aa56e0dd-56ee-47e1-8fc2-3fa70d7a62d2",
        "name": "sonra.eutialyson.com"
      },
      {
        "id": "556b1120-fcba-4900-ba7f-9b436c606806",
        "name": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b"
      },
      {
        "id": "0f270fb5-dc47-40f8-8473-f6d8e3a2f40e",
        "name": "rule-bead-dust.xyz"
      },
      {
        "id": "b50c178a-8d25-4635-8ad5-8ac2fc28dc4b",
        "name": "anus-staylard.xyz"
      },
      {
        "id": "ec19ae9d-7ecb-4179-b97c-006c36a7b634",
        "name": "fair-bath-fond.xyz"
      },
      {
        "id": "c3c52f6f-c888-4a34-8e7e-153ebad12bf5",
        "name": "https://resumeacceptable.com"
      },
      {
        "id": "727bcf8c-be2e-4af8-8b5d-f67f42a0e1ff",
        "name": "uglyshop-mare.xyz"
      },
      {
        "id": "78f2bbed-b0f4-49ea-8ae3-7dae975ad298",
        "name": "http://sonra.eutialyson.com/inst24.msi"
      },
      {
        "id": "4f099cf7-d68f-4a21-9b7b-5521a3e017f4",
        "name": "pestrear-lamp.xyz"
      },
      {
        "id": "f12e5ee7-6093-4da3-a813-ed0f473098f6",
        "name": "213.165.41.26"
      }
    ],
    "attack_patterns": [
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "5d2af906-6187-4702-ab9f-590fbe5b1ca3",
        "name": "T1021.002"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "9643a7e9-771b-4396-83a3-26fcec5200e4",
        "name": "T1021.006"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "eaed9e28-8072-48ff-bd94-ed7d72554636",
        "name": "T1218.005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6c31e3ae-7a24-4c3b-8a2a-f769c351a2af",
        "name": "T1568.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "64e548d5-24de-4894-9c90-c6e17b3b3bee",
        "name": "T1056.002"
      }
    ],
    "malware": [
      {
        "id": "9692c211-5138-4d8e-8cb5-3bcbed9970cb",
        "name": "Potemkin",
        "slug": "potemkin"
      },
      {
        "id": "eee86897-6bfb-40f1-b68c-9e79f593b70f",
        "name": "Chisel",
        "slug": "chisel"
      },
      {
        "id": "4c5f5285-091d-4bf7-8c48-f6b5e6e38fee",
        "name": "EtherRAT",
        "slug": "etherrat"
      },
      {
        "id": "8b2d304c-a047-4695-a417-fb4790f8a993",
        "name": "RMMProject",
        "slug": "rmmproject"
      }
    ],
    "observables": [
      {
        "id": "2dbbd222-4353-45b1-9f51-4326b0901db8",
        "name": "uglyshop-mare.xyz"
      },
      {
        "id": "80ba8446-8158-44ef-8c8a-8c6b32bbe84d",
        "name": "rule-bead-dust.xyz"
      },
      {
        "id": "315c1beb-a37b-423d-a55f-d61597fb6fc5",
        "name": "anus-staylard.xyz"
      },
      {
        "id": "356feba1-5ef9-47c6-b375-2dfaddaf8de8",
        "name": "pestrear-lamp.xyz"
      },
      {
        "id": "4d387da9-df88-4d51-a6bf-b3724313a1f2",
        "name": "fair-bath-fond.xyz"
      },
      {
        "id": "17999a18-1ef7-4a19-9183-0ad5028df9da",
        "name": "resumeacceptable.com"
      },
      {
        "id": "bf5ba2c4-dc5e-40bc-be00-3a9a922f7273",
        "name": "sonra.eutialyson.com"
      },
      {
        "id": "9af71903-9cdf-465d-9287-81116efbae0a",
        "name": "cl.distritovagas.com"
      },
      {
        "id": "5a91f12d-62cb-462b-8cd7-240a72db09a8",
        "name": "213.165.41.26"
      },
      {
        "id": "8ededc4a-c267-4e81-8ce0-387509c789b3",
        "name": "77.110.122.58"
      },
      {
        "id": "d207e0dc-c970-4fdc-8247-dab011cde3f4",
        "name": "http://77.110.122.58:44479/bjxxUmG8K3uy.ps1"
      },
      {
        "id": "037c9738-c836-4958-a89d-431c663b3bc3",
        "name": "http://77.110.122.58:23205/cons_1.0.1.msi"
      },
      {
        "id": "56d1e143-8d00-4de7-a685-1144355243ed",
        "name": "http://sonra.eutialyson.com/inst24.msi"
      },
      {
        "id": "b6f921d7-7757-45c5-961e-eb718664cd41",
        "name": "https://cl.distritovagas.com/hte.hta"
      },
      {
        "id": "a6c3b243-a520-4141-ac7a-a0f8ff473d64",
        "name": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe'"
      },
      {
        "id": "e173dbfc-b114-45a5-b0f0-783f5874db36",
        "name": "https://resumeacceptable.com"
      },
      {
        "id": "7da93f9e-756a-4c0e-a263-899624ba5e97",
        "name": "http://77.110.122.58:23205/lQhEQui9a4lZ.exe"
      },
      {
        "id": "",
        "name": "3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce"
      },
      {
        "id": "",
        "name": "2ada24dd6e517f37942b749c2bd57ddd97445e9853002cee70a0bc30d0b0ce3a"
      },
      {
        "id": "",
        "name": "2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b"
      },
      {
        "id": "",
        "name": "cd4e5e2c65b1660470d3446539ee68adf5faeece3eaeb46583623be9911ee145"
      },
      {
        "id": "",
        "name": "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "cl.distritovagas.com"
      },
      {
        "id": "",
        "name": "resumeacceptable.com"
      },
      {
        "id": "",
        "name": "sonra.eutialyson.com"
      },
      {
        "id": "",
        "name": "rule-bead-dust.xyz"
      },
      {
        "id": "",
        "name": "anus-staylard.xyz"
      },
      {
        "id": "",
        "name": "fair-bath-fond.xyz"
      },
      {
        "id": "",
        "name": "uglyshop-mare.xyz"
      },
      {
        "id": "",
        "name": "pestrear-lamp.xyz"
      }
    ]
  },
  "external_refs": [
    {
      "id": "96d0fb4d-6bac-4696-9170-2d1940cda7eb",
      "standard_id": "external-reference--4e188d3a-30c2-5f79-922c-2f8e0d8cc631",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack",
      "hash": null,
      "external_id": null,
      "created": "2026-06-16T17:19:15.809Z",
      "modified": "2026-06-16T17:19:15.809Z",
      "createdById": null
    },
    {
      "id": "b9fadc23-3771-46d6-876b-740fdfa71be1",
      "standard_id": "external-reference--b5d273e8-86cb-5447-af87-70b3c98b15e1",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a315d670f9460fe003298a8",
      "hash": null,
      "external_id": "6a315d670f9460fe003298a8",
      "created": "2026-06-16T17:19:15.778Z",
      "modified": "2026-06-16T17:19:15.778Z",
      "createdById": null
    }
  ]
}