NetSupportRAT

Description

NetSupportRAT is the legitimate NetSupport Manager remote administration tool that cyberattackers frequently abuse for remote access to victim systems. Because the vendor signs the software and many enterprises run it legitimately, intrusions that rely on it often escape scrutiny that unsigned malware receives. Threat actors distribute it through malvertising, phishing, and fake software downloads, and researchers documented a campaign that abused Google Ads to reach victims.

Stats

First seen

September 2023

Last seen

October 2026

Also known as

Alert name variants