Criminal groups routinely deliver unauthorised copies of the legitimate NetSupport Manager client as a remote access trojan, and because the binary is genuine and signed, file reputation alone rarely stops it. Security researchers call these unauthorised deployments "NetSupport RAT". Red Canary ranked NetSupport Manager the fourth most prevalent threat in its 2025 Threat Detection Report, and the most common delivery route it saw that year was malicious copy and paste (ClickFix). This guide explains how abused clients arrive, which artefacts separate them from sanctioned installs, how to detect and contain them, and how to govern any legitimate NetSupport estate so that it cannot be confused with an intruder. It is written for SOC analysts, detection engineers and endpoint administrators. It is defensive only: it describes behaviours and artefacts, not attacker procedures.
This is an independent guide from NHI Mgmt Group. NetSupport Manager is a commercial remote control product; the abuse described here is by criminals using unauthorised copies, not by the vendor. Hardening points for legitimate deployments are based on NetSupport's public knowledge base as of November 2026. It is not sponsored or reviewed by NetSupport. Product features change, so confirm settings against NetSupport's current documentation.
Key takeaways
- The tool is legitimate; the deployment is not. Abused clients are real NetSupport Manager binaries, often signed and sometimes renamed, so detection has to rest on location, configuration, parent process and network destination.
- ClickFix and fake updates dominate delivery. eSentire, SANS ISC and Cisco Talos all describe fake CAPTCHA pages that get users to paste a command into the Run dialog, with fake browser updates as the older route.
- Location is the cheapest signal. Sanctioned installs live under Program Files; abused clients run from ProgramData, AppData or Downloads, which public Sigma rules and Red Canary both use.
- Persistence is ordinary and visible. Reported cases use HKCU Run values, Startup folder shortcuts and logon scheduled tasks, all of which EDR and Windows logging can capture.
- Allowlisting closes the gap. CISA, NSA and MS-ISAC advise blocking installation and execution of unauthorised portable remote tools; a governed NetSupport estate makes every other copy an alert.
What NetSupport RAT is
NetSupport Manager has three relevant components: the Client installed on the managed machine (client32.exe), the Control used by the operator, and the Connectivity Server or Gateway that brokers connections when Client and Control cannot reach each other directly. Red Canary notes the product has been in use for more than 30 years and that a free trial is easy to obtain, which contributes to its misuse. In malicious use the operator ships a Client package with a configuration file (client32.ini) pointing at an actor-controlled gateway, and the endpoint calls out to it over HTTP or HTTPS. Once connected the operator gets the product's normal capabilities: screen viewing and capture, keyboard and mouse control, file transfer, process and service management and a remote command prompt.
| Package element | Role | Why defenders care |
|---|---|---|
| client32.exe | NetSupport Client executable | Primary hunting target; may be renamed (Talos saw hypersnap.exe, Microsoft saw presentationhost.exe) |
| client32.ini | Client configuration, including gateway address and interface settings | Holds the connection target; Talos describes silent settings with no tray icon and chat and disconnect controls disabled |
| NSM.lic | Licence file | Present in abused packages; licence details can help cluster campaigns |
| HTCTL32.DLL, PCICL32.DLL and runtime DLLs | Client dependencies | Signed DLLs loaded from user-writable folders are a strong signal |
| remcmdstub.exe | Remote Command Prompt Stub | Listed by the LOLRMM project; enables remote command execution |
| pcicfgui.exe | Client Configurator | Matched by the public Sigma rule for NetSupport execution |
The broader family of remote tools, and how to govern them, is covered in the RMM Tool Security Guide. This page focuses on NetSupport-specific delivery, artefacts and response.
How abused clients arrive
Delivery has shifted over time, but every reported route ends with a user-context execution that drops a self-contained Client package.
| Route | What is reported | Reporting source | ATT&CK |
|---|---|---|---|
| ClickFix fake CAPTCHA | Injected script on a compromised site shows a "verify you are human" page; the user pastes a command into Run, which fetches a script and then a zip containing the Client | eSentire (February 2025), SANS ISC (November 2025), Cisco Talos (September 2026) | T1204.004 Malicious Copy and Paste |
| Fake browser updates | Compromised sites push a fake update that installs the Client, the original route for SmartApeSG and SocGholish-linked activity | SANS ISC, eSentire, Red Canary | T1189 Drive-by Compromise |
| Malvertising and SEO | NetSupport deployed alongside infostealers in later stages, in one case renamed to presentationhost.exe | Microsoft Threat Intelligence (March 2025) | T1105 Ingress Tool Transfer |
| Follow-on from another malware | A stealer or loader installs the Client after automated collection, giving hands-on access | Cisco Talos (Amatera stealer branch), Red Canary | T1105 Ingress Tool Transfer |
| Phishing | Lures and attachments that lead to the same package | Red Canary | T1566 Phishing |
Groups named in primary research: SANS ISC and eSentire tie ClickFix delivery of NetSupport to the SmartApeSG campaign (also tracked as ZPHP or HANEYMANEY), and eSentire also names TA569. Microsoft tracks the March 2025 malvertising activity as Storm-0408, a designation covering several actors. Red Canary links NetSupport to Scarlet Goldfinch, FakeSG, SocGholish, Qbot and MSIX campaigns. Use these names for intelligence correlation only; the same Client package is used by many unrelated operators. For the delivery techniques themselves see the ClickFix Fake CAPTCHA Attacks Guide and the SocGholish and Fake Browser Update Malware Guide.
Artefacts that separate abuse from sanctioned use
The most reliable approach compares every NetSupport artefact with what your own approved deployment looks like. If you have no approved deployment, any NetSupport artefact is worth triage.
| Artefact | Sanctioned install (typical) | Reported in abuse |
|---|---|---|
| Install path | C:\Program Files or Program Files (x86)\NetSupport\NetSupport Manager | Folders under C:\ProgramData (SANS ISC, Red Canary), AppData (Talos, Blackpoint), Downloads or Roaming (Red Canary) |
| File name | client32.exe | client32.exe or a renamed copy with OriginalFileName still client32.exe |
| Installation | Service named Client32 created by an installer or software distribution tool (System event 7045) | No service; extracted from a zip and run in user context |
| Persistence | Windows service | HKCU Run value (Blackpoint saw a value named Support11), Startup folder .url or Start Menu shortcut launching a .js file in Temp (SANS ISC), logon scheduled task (Talos) |
| Parent process | Software deployment agent, services.exe | PowerShell, cmd, wscript or mshta launched from an explorer Run dialog |
| Gateway | Your own Connectivity Server with your gateway key | Actor-controlled gateway, often on TCP 443, with paths containing fakeurl.htm (eSentire) and polling roughly every 60 seconds (Talos) |
| Other network | Internal Control hosts or your gateway | Connections from client32 binaries to netsupportsoftware.com domains, which Red Canary lists as a sign of suspicious use |
| User interface | Tray icon, user acknowledgement prompts as configured | No tray icon, chat and disconnect controls hidden |
Detection engineering
Data sources
- Process creation: Sysmon event ID 1 or Windows Security event 4688 with command line, plus EDR process telemetry including PE metadata (OriginalFileName, Product, Company) and imphash. See the EDR Telemetry Guide.
- Registry: Sysmon event ID 13 for Run key writes and the RunMRU key that records Run dialog commands.
- Scheduled tasks and services: Security event 4698 (task created) and System event 7045 (service installed).
- File creation: Sysmon event ID 11 for zip archives and executables written to ProgramData and AppData.
- Network and DNS: Sysmon event ID 3 and 22, proxy and DNS logs for gateway connections and lookups of netsupportsoftware.com domains.
Analytics to build
| Analytic | Logic in words | Tuning note | ATT&CK |
|---|---|---|---|
| NetSupport outside Program Files | Process with image client32.exe, Product containing NetSupport Remote Control, OriginalFileName client32.exe or the known imphash, where the path is not under Program Files (Sigma: "Remote Access Tool - NetSupport Execution From Unusual Location") | Very low false positives where no portable use is approved | T1219.002 Remote Desktop Software |
| Renamed client | PE metadata says client32.exe but the image name differs (Sigma: "Renamed NetSupport RAT Execution") | High fidelity; alert at high severity | T1036.003 Rename Legitimate Utilities |
| Client after Run dialog | A RunMRU write by explorer.exe followed within minutes by script host or PowerShell activity and then a NetSupport process | Correlate on host and user; ClickFix chains complete quickly | T1204.004 Malicious Copy and Paste |
| User-context persistence | New HKCU Run value, Startup shortcut or logon task pointing to ProgramData, AppData or Temp, where the target has NetSupport metadata or launches a .js file | Baseline legitimate per-user auto-starts first | T1547.001, T1053.005 |
| Unapproved gateway | NetSupport process connecting to any destination other than approved gateway or Control hosts, or periodic 443 connections at a fixed interval | Maintain the approved gateway list as a lookup | T1071.001 Web Protocols |
| Unexpected service install | System 7045 with service Client32 on a host outside the managed NetSupport scope (Sigma: "NetSupport Manager Service Install") | Exclude hosts in the sanctioned deployment group | T1543.003 Windows Service |
Hash and domain indicators from vendor reports age quickly: SANS ISC notes that the domains, package and command server in the SmartApeSG chain change frequently. Load published indicator files into retro-hunts, but build durable detections on location, metadata, parent chain and gateway behaviour. Signed binaries are not proof of authorisation, as Talos stresses for the renamed client it analysed.
Prevention and hardening
| Control | Effect on NetSupport abuse | Business impact | Fit |
|---|---|---|---|
| Application control (WDAC or AppLocker) allowing NetSupport only from Program Files, or not at all | Blocks the user-context Client before it connects | Low if no portable remote tools are approved | All managed Windows estates; see AppLocker vs WDAC |
| Disable the Run dialog for standard users via Group Policy | Breaks the ClickFix paste step | Some support workflows and power users affected | Kiosks, call centres, most office users |
| Restrict script hosts (wscript, mshta) through application control | Breaks .js and HTA stages | Low for most users | Broad |
| Attack surface reduction rules: block executables unless they meet prevalence, age or trusted-list criteria; block obfuscated scripts; block JavaScript or VBScript launching downloaded content | Stops several stages of the chain | Run in audit mode first | Microsoft Defender estates |
| Egress filtering and protective DNS | Blocks known gateways and new domains | Low | Broad; see the Protective DNS Guide |
| Remove local admin and user software installs | Limits service-based persistence; does not stop portable execution on its own | Moderate | Broad |
| User awareness on paste-to-run prompts | Reduces successful lures | Low | Broad |
The CISA, NSA and MS-ISAC advisory AA23-025A explains why portable remote tools get past installation controls: they run with standard user rights, need no installer and rarely trigger antivirus. Its mitigations (audit authorised remote tools, block installation and execution of unauthorised portable versions, review logs for unusual execution) apply directly to NetSupport.
If you use NetSupport Manager legitimately
A governed estate makes abuse easier to see. NetSupport's knowledge base lists the controls below for version 12.80 and earlier; check your version's documentation.
- Security key: set a Client security key so only Controls holding it can connect.
- User authentication: require NT or AD group authentication for Control operators; smartcard authentication is also available.
- Gateway keys and operators: use gateway keys and named gateway operator accounts on the Connectivity Server, and remove operators to revoke access.
- Encryption: select 256-bit AES rather than relying on the stated defaults.
- User acknowledgement and logging: turn on acknowledgement prompts where appropriate, Client and Control logging, and replay files for sensitive hosts.
- Enforce centrally: apply Client settings through AD Group Policy templates, which override local configuration, and lock the Client Configurator with a password or group.
- Inventory: record the approved install path, service name, gateway hosts and licence so every analytic above has a clean exclusion list.
Where identity fits
An abused Client gives the operator the logged-on user's session, so the immediate identity risk is everything that user can reach: browser sessions, cached tokens, mapped drives and any API keys or cloud credentials stored on the machine. Talos describes NetSupport installed after a stealer had already collected data, and Picus notes credential dumping and lateral movement following access. Treat a confirmed NetSupport RAT as a credential exposure event for the user and for any non-human credentials on the host.
For legitimate deployments, the gateway key, Client security key and Control operator accounts are shared secrets that grant remote control of the estate. Store them in a vault, rotate them when administrators leave, and avoid using the licence serial as the security key on high-value hosts. See the Secrets Management Guide.
Response when NetSupport RAT is confirmed
- Isolate the host through EDR network containment rather than powering it off, to keep memory and live connections.
- Block the gateway at proxy, firewall and DNS, then search for every other host contacting it or polling at the same interval.
- Preserve evidence: the package folder (client32.ini, NSM.lic, binaries), persistence entries, RunMRU, PowerShell script block logs (event 4104), browser history for the lure page and EDR timelines.
- Scope operator activity: NetSupport Client logs if enabled, file transfers, new processes started by the Client, and any credential access or lateral movement after the connection time.
- Reset credentials: revoke the user's sessions and refresh tokens, reset the password, and rotate any secrets or keys present on the host.
- Eradicate and recover: remove persistence and package files, or reimage where follow-on payloads are found; Red Canary and eSentire both note NetSupport as a precursor to further payloads.
- Close the entry point: report the compromised website, add the lure domain to blocks and check whether Run dialog and script host restrictions would have stopped the chain.
For wider containment decisions see the RMM Tool Security Guide section on responding to unauthorised RMM.
Detection and measurement
- Coverage: percentage of Windows endpoints sending process creation with PE metadata, registry and network telemetry.
- Prevention: percentage of endpoints where application control blocks NetSupport outside the approved path, verified by a harmless test file with matching metadata in a lab.
- Exposure: number of hosts with NetSupport artefacts outside the sanctioned deployment, trending to zero.
- Speed: median time from first NetSupport execution in a user-writable path to containment.
- Chain breakage: blocked Run dialog or script host launches per month, reviewed for lure trends.
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ATT&CK |
|---|---|---|---|
| Block unauthorised remote tools | PR.PS-05 | CM-7, CM-10, CM-11 | M1038 Execution Prevention, M1033 Limit Software Installation |
| Detect abused clients | DE.CM-09 | SI-4, SI-3 | T1219.002 Remote Desktop Software, T1036.003 Rename Legitimate Utilities |
| Delivery | AT-2 | T1204.004 Malicious Copy and Paste, T1189 Drive-by Compromise, T1566 Phishing | |
| Persistence | DE.CM-09 | SI-4 | T1547.001 Registry Run Keys / Startup Folder, T1053.005 Scheduled Task |
| Command and control | DE.CM-01 | SC-7 | T1071.001 Web Protocols, T1105 Ingress Tool Transfer |
| Containment | RS.MI-01 |
CIS Controls v8.1 Control 2 (Inventory and Control of Software Assets), including allowlisting authorised software, is the most direct safeguard family.
Common failure patterns
- Trusting the signature: allowing anything signed by the vendor, which lets every abused copy run.
- Blocking by file name: rules on client32.exe alone miss renamed copies that keep their PE metadata.
- No baseline: a legitimate NetSupport estate with no documented paths, gateways or keys, so analysts cannot tell abuse from support work and close alerts as benign.
- Indicator-only hunting: relying on published hashes and gateway IPs that rotate within days.
- Cleaning without credential reset: removing the Client but leaving the user's sessions, tokens and stored keys valid after an operator had hands-on access.
- Run dialog left open: application control on executables but no restriction on the Run dialog or script hosts that start the chain.
Practitioner checklist
- Decide whether NetSupport Manager is approved; if it is, document install path, service, gateways, keys and licence.
- Deploy application control so NetSupport binaries run only from the approved path, or nowhere.
- Enable the public Sigma-equivalent analytics for unusual location, renamed client and unexpected service install.
- Collect RunMRU, Run key, scheduled task and PowerShell script block telemetry and correlate it with NetSupport execution.
- Restrict the Run dialog and script hosts for standard users after an audit period.
- Block lookups of netsupportsoftware.com domains from hosts outside the sanctioned estate and alert on them.
- Write a response runbook that includes credential and secret rotation for the affected user and host.
- For legitimate use, enforce security keys, AD authentication, AES 256 encryption and logging through Group Policy.
Standards and references
- CISA, NSA and MS-ISAC: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
- NetSupport: What security settings are available in NetSupport Manager
- Red Canary: Threat Detection Report, NetSupport Manager
- Cisco Talos: ClearFake WebDAV infection chain
- eSentire: NetSupport RAT ClickFix distribution
- SANS ISC: SmartApeSG campaign uses ClickFix page to push NetSupport RAT
- Microsoft Threat Intelligence: Malvertising campaign leads to info stealers hosted on GitHub
- SigmaHQ: Remote Access Tool, NetSupport execution from unusual location
Related NHI Mgmt Group resources: RMM Tool Security Guide · ClickFix Fake CAPTCHA Attacks Guide · SocGholish and Fake Browser Update Malware Guide · Living off the Land Guide · EDR Guide