NetSupport RAT hits freight carriers from servers shared with a mass-mail panel

A crew is installing the NetSupport Manager remote access tool through VBS scripts whose decoys imitate freight rate confirmations and contracts of carriage.

One of the crew's delivery servers sits in a MivoCloud /24 that also hosts FlyMail, a Russian-language email and Telegram outreach platform built to be resold as a service. Matching domain purchases, a shared NetSupport server and a shared DNS name tie the two operations together.

Snoopy Triage, Tuxxin's threat analysis platform, decoded the chain and mapped the servers.

Status on November 4, 2026, 13:50 UTC:

• The MivoCloud delivery server came back on November 3 under a new domain with the same NetSupport package. It went offline again at 00:30 UTC on November 4, about 10 hours after our follow-up report.
• The Kyonix delivery server is still online. It serves the kit on docsforsend[.]com, with a new stage2.js build since November 3.
• Both command-and-control (C2) servers still accept connections on port 443.
• The FlyMail login on 194.180.191[.]209 no longer loads. coblla[.]com still serves the FlyMail login, now behind Cloudflare.

How the sample surfaced

On October 29, 2026, @malwrhunterteam posted the delivery domain checkyoursecurityfast[.]com. @smica83 followed with a related script, "Document 9523_0951.vbs", uploaded to MalwareBazaar. Earlier, @skocherhan had tagged nairawaterfall[.]com on the MivoCloud server and two domains on Kyonix 150.241.66[.]223 as NetSupport on October 23, and four more domains, including gosidefastandpure[.]com, on October 24.

The infection chain

We have not seen the message that carries the first stage. The sample reached MalwareBazaar as "Document 9523_0951.vbs", a document-style name on a script file, and both decoys are freight paperwork, which points to lures sent to carriers and brokers. The sender, subject lines and delivery channel are unconfirmed. Mail filters can still act on the file type: a .vbs file named like a document.

1. A VBS posing as a WebView2 check

The script calls itself a "Microsoft Edge WebView2 Runtime Compatibility Check" and writes a WMI system profile to %TEMP%\EdgeWebView2Check.log. It continues only on Windows 10 or later (build 10240+) with at least 200 MB of free disk space.

It decodes the second stage with a custom base64 alphabet, DTHgzjiA9aReU7OoxqwySLsPQ_NvJpmFKWkIE8421C0clZGu3Mh-BXfbYnrdV65t. It then subtracts 71 from each byte. The result goes to a random .vbs file in %TEMP%, runs under cscript and is deleted.

2. A VBS downloader

The second script stores its configuration in a process environment variable as a pipe-separated list: install folder names, the client's disguise name and the delivery URLs. It downloads stage2.js and runs it as JScript:

hxxps://cdn.checkyoursecurityfast[.]com/stage2.js?id=8d67e7c2&env=X_FE39CB

3. stage2.js, a fake jQuery 3.6.0

stage2.js opens with a copy of jQuery 3.6.0 and hides its dropper in a function named _internalCacheInit. In order, it:

1. Reports progress to /track?id=<victim id>&stage=stage2:running, then files:ok, then persist:ok&pcname=<computer name>.
2. Opens a decoy PDF through rundll32 url.dll,FileProtocolHandler.
3. Downloads /assets/pkg/package.tar.gz with curl.exe and unpacks it with tar into %APPDATA%\UpdateHelper, with copies in %LOCALAPPDATA%\Microsoft\Edge\ComponentUpdate and a hidden %LOCALAPPDATA%\Microsoft\EdgeUpdate\backup.
4. Installs handler.bat and watchdog.vbs, a 60-second restart loop, in %LOCALAPPDATA%\Microsoft\EdgeUpdate\runtime.
5. Persists through the HKCU Run value MicrosoftEdgeSpellCheck, plus EdgeUpdate.vbs and MicrosoftEdgeWebView.lnk in the Startup folder.

Each download of stage2.js without an id parameter carries a fresh 8-character victim ID. The backend mints an ID per download and tracks each victim's progress through the /track beacons.

4. The NetSupport client

The package holds a standard NetSupport Manager client. client32.exe is renamed msedgewebview.exe and runs silently. The license file in the package we recovered from the MivoCloud server carries licensee GJHYUT534 and serial NSM280812, a license common in cracked NetSupport builds. The license file on the Kyonix server (fetched November 4) is byte-identical, so both builds carry licensee GJHYUT534 and serial NSM280812.

Both client32.ini files we recovered were made with a tool named NetSupportConfigBuilder. Each records the builder's folder path, which makes the paths below useful fingerprints for grouping builds. The Windows user names in them (antim, Administrator) are build-machine accounts and identify no one.

The decoy documents

Both delivery servers serve the same decoy, /assets/docs/document.pdf: a genuine-looking US freight rate confirmation from February 2024, signed through DocuSign. On October 22, 2026, the MivoCloud server added eudoc.pdf, a Czech contract of carriage between a freight forwarder and a Croatian haulier dated September 18, 2026. The second decoy shows the crew widening from US carriers to European ones.

Both PDFs name real companies and people. We withhold those names and keep the files out of public distribution.

Remote access to carrier and broker systems is a known route to cargo theft, where loads are booked and diverted under a legitimate carrier's name.

Delivery infrastructure

Both delivery servers run Apache on Debian. Port 80 serves the Debian default page for every hostname, and port 443 serves the kit. Each kit domain gets cdn., download. or downloads. hostnames, and /assets/pkg/ is an open directory listing.

MivoCloud server 194.180.191[.]245 (AS39798)

A Haulmer store subdomain, joseriquelme-tienda1.haulmer[.]com, also pointed here from September 1 to 12, 2026, and has since returned to Haulmer. The package on this server is dated October 8, 2026.

Kyonix server 2.27.63[.]78 (AS210457)

The NetSupport files on this server date from September 23, 2026, and the package from September 28, so it carries the older of the two builds. The transunionbiba[.]lat builds used hardcoded URLs, the install folder %APPDATA%\DriverWebUpdate and the client name updaterdriveon.exe. Later builds read their names from the stage 2 environment variable. All builds share the same persistence names.

A third Kyonix address, 150.241.66[.]223, hosted sakenlogistics[.]com and youlovemybiba[.]com (NameSilo, September 2026). Neither answers today.

The November 2 domain rotation

On November 2, 2026, the crew replaced ajtrucking[.]lat with docsforsend[.]com on the same Kyonix server:

ajtrucking[.]lat still resolves to the Kyonix server, and since November 3 its /assets/pkg/ listing answers again.

The kit is unchanged. The new stage2.js differs from the ajtrucking[.]lat copy only in the victim ID and the decoy URL, and the new client32.ini still points to 192.162.199[.]79:443 with the same GSK and builder path. Spamhaus listed docsforsend[.]com as botnet C2 the same day.

Our abuse report for ajtrucking[.]lat went to Kyonix on November 1. The server still serves the kit under the new name. The rotation was the crew's move, and we found no sign that Kyonix acted.

Update: November 3 and 4

The MivoCloud server returned under a new name. verifyconnectionsecurely[.]com was registered at NICENIC, the crew's usual registrar, on November 2 at 18:42 UTC, while the MivoCloud server was dark. From November 3, 12:17 UTC it resolved to 194.180.191[.]245 with the apex, cdn. and downloads. hostnames. /track answered 204 and /assets/pkg/ was again an open listing. Its package.tar.gz is byte-identical to the checkyoursecurityfast[.]com package (SHA-256 60c8fa7f...), and its client32.ini still points to 91.202.233[.]57:443. The November 2 outage was therefore a pause. We sent MivoCloud a follow-up report on November 3 at 14:31 UTC. The server stopped answering on November 4 at 00:30 UTC and has stayed down; the domain still resolves to it. MivoCloud has not replied.

A new stage2.js build on docsforsend[.]com. Since November 3, download.docsforsend[.]com/stage2.js serves a shorter build of 9,025 bytes. It still opens with the jQuery 3.6.0 banner and keeps _internalCacheInit, the three /track stages and the persistence names (MicrosoftEdgeSpellCheck, EdgeUpdate.vbs, MicrosoftEdgeWebView.lnk, watchdog.vbs, handler.bat). It copies the NetSupport files to %APPDATA%\DriverWebUpdate, the folder of the transunionbiba[.]lat builds, and adds a launcher.vbs. Its decoy is hxxps://download.docsforsend[.]com/assets/docs/document.pdf. Each download carries its own victim ID, so the file hash changes per download. The package listing still holds the September 23 files and the September 28 package. The whack.sh dropper rule matches this build.

Command and control

Both C2 servers accept connections on port 443 and give no answer to plain HTTP requests, which fits a NetSupport gateway. A NetSupport gateway handles the client's own POST traffic to /fakeurl.htm, and OTX logged hxxp://192.162.199[.]79/fakeurl.htm on September 28, 2026.

91.202.233[.]57 sits in 91.202.233.0/24, announced by Prospero OOO (AS200593). 192.162.199[.]79 belongs to FEMO IT Solutions (AS214351, UK registration). Spamhaus lists both addresses on SBL and DROP.

The 192.162.199[.]79 domain pool

Passive DNS from issued.live shows 33 hostnames on 192.162.199[.]79 since August 2026. On November 2, 22 of them still resolve to it, and Spamhaus lists 20 of those as botnet C2 domains.

21 of the 22 are aged .net names, re-registered between June 23 and August 3, 2026. All of them were pointed at the C2 in one wave on August 24 to 26. The aged Namecheap domains appeared on the MivoCloud delivery server on the same three days. Registry RDAP shows two registration styles:

Both recovered client32.ini files name the C2 by its raw IP address, and we hold no sample that names a pool domain. Nothing shows the freight kit itself using these .net names. They may serve other builds, act as a fallback, or belong to a different kit on the same address.

The other 11 names on this address resolve elsewhere or nowhere today: ldsb[.]net, six short-lived .cc names from August 2026 (acurev, cernao, ceruan, curaen, seorna, asenov), avosun.eu[.]cc, sucora[.]cz, vusane[.]top and mauriea.my[.]id. We do not attribute them, since a bulletproof address can change tenants.

FlyMail: a mass email and Telegram platform built for resale

FlyMail, also branded SmartMail with a stylesheet named "BLUE STEEL", is a Russian-language platform for mass email and Telegram outreach. Its login page reads "FlyMail - Vkhod" ("FlyMail - Sign in").

The app behind the login has several sender mailboxes with display names, letter templates per language with photo and video kits, a persona text block, a per-contact correspondence history that marks media already sent, and blacklists. It has no click, open or conversion tracking.

An operator panel titled "FlyAdmin - panel operatora" is built to manage client systems. The front-end React source, 11 files, was readable on the server; the backend was not, so the list below describes what the interface offers. The panel:

• Provisions each client "system" on a new MivoCloud VPS through MivoCloud's API (product IDs 441 to 444, six locations).
• Has a price field for each system and computes income and profit from it. We saw no transaction records.
• Keeps each system's email and Telegram contact bases, exportable to CSV.
• Schedules updates in Moscow time and issues registration links in the form hxxp://<ip>/register/<token>.

On November 2, the FlyMail login on .209, coblla[.]com, admin.coblla[.]com and the three other FlyAdmin domains were all online. By November 4 the login on .209 no longer loads. coblla[.]com moved behind Cloudflare at 00:32 UTC that day, and its FlyMail login still loads.

The coblla[.]com certificates trace the build-out: main site August 9, mail September 6, movie September 9, FlyAdmin September 26 and chat October 10, 2026. A sweep of all 5,340 MivoCloud (AS39798) addresses found no other FlyMail or FlyAdmin panel. The resale panel is young: FlyAdmin went live on September 26, 2026, and its dashboard charts still show placeholder data.

How the two operations connect

Each overlap below comes from registration data, passive DNS or Spamhaus. Together they indicate common control. None of them identifies a person.

The FlyMail operator let its October 2025 domains lapse at their first anniversary. On November 2, 2026, the two Tucows names sit on the registrar's expiry parking, and the two PDR .info names point to 127.0.0.1 under PDR's parking nameservers.

Earlier activity

gosidefastandpure[.]com appears in OTX pulses from March 14 to 21, 2026. In those pulses it served a fake CAPTCHA page at /captcha and recorded each victim's progress through /<32-hex token>/started, /completed and /failed. The same habit returns in October as /track?stage=, so the crew ran ClickFix-style lures from at least March 2026, before the VBS chain.

Timeline

Takedown status

194.180.191[.]239 (gosidefastandpure[.]com), 5.252.177[.]183 (forzaverification[.]com) and 150.241.66[.]223 (sakenlogistics[.]com) also no longer answer. We did not report them.

Detection

On endpoints, look for:

• msedgewebview.exe or updaterdriveon.exe running from %APPDATA%\UpdateHelper, %APPDATA%\DriverWebUpdate or %LOCALAPPDATA%\Microsoft\Edge\ComponentUpdate.
• The HKCU Run value MicrosoftEdgeSpellCheck.
• EdgeUpdate.vbs or MicrosoftEdgeWebView.lnk in the Startup folder.
• watchdog.vbs and handler.bat in %LOCALAPPDATA%\Microsoft\EdgeUpdate\runtime.
• %TEMP%\EdgeWebView2Check.log.
• launcher.vbs, added by the November 3 build.
• curl.exe and tar.exe launched by wscript.exe or cscript.exe.

On the network, look for:

• Requests to /stage2.js?id=, /track?id=...&stage= and /assets/pkg/package.tar.gz.
• Outbound TCP 443 to 91.202.233[.]57 or 192.162.199[.]79, or POSTs to /fakeurl.htm.

whack.sh scans flag the stage2.js dropper in all six builds we hold, from transunionbiba[.]lat through the November 3 docsforsend[.]com build, and client32.ini files made with NetSupportConfigBuilder.

Indicators

Domains

IP addresses

SHA256

Not linked

• 172.104.98[.]35 (Linode): a shared sinkhole or parking address with more than 430 unrelated domains.
• Akamai 23.x addresses: registrar parking.
• The forum seller "smartmail" (zenno.club, zenno-bots[.]top): same name, no shared infrastructure.
• A fake-employer recruitment kit (novabeyondapply[.]com, norlin-solutions[.]works and others) with redirectors on MivoCloud 5.252.177[.]82: it shares only the hosting provider, and its stack differs.
• telluapp[.]top, a Russian-language Telegram mini-app on Kyonix: no shared infrastructure with FlyMail.

Sources and evidence gaps

Third-party data came from Spamhaus (DBL, SBL, DROP), urlscan.io, OTX, MalwareBazaar, Cert Spotter, RIPEstat and registry RDAP. Passive DNS and certificate history came from issued.live.

We hold no NetSupport sample that names a C2 pool domain, and no hosting provider has confirmed the account behind any server.

Thanks to @malwrhunterteam, @skocherhan and @smica83, whose public posts started and extended this investigation. Analysis by Snoopy Triage.