Home

DeviceManager RAT

Remote access trojan (Python-based, modular) · Delivered by DOUBLECUP (ClickFix LaaS) · First documented August 2026 ·

Overview

DeviceManager is a modular, Python-based Windows remote access trojan first documented in August 2026 by SOCRadar's Threat Research Unit during analysis of a loader-as-a-service platform named DOUBLECUP. It is not a self-spreading commodity family. It is a hands-on backdoor that arrives at the end of a ClickFix social-engineering chain, gives an operator full command execution on the host, and is engineered specifically to survive infrastructure takedowns and network monitoring.

The delivery vehicle is what makes DeviceManager notable for defenders. DOUBLECUP is a Russian loader-as-a-service, active since early June 2026, that sells operators a builder and hosts the delivery infrastructure for ClickFix campaigns. It stages a steganographic PNG in the victim's browser cache, hijacks the clipboard through a fake CAPTCHA prompt, and relies on the victim to paste and run the command themselves. There is no exploit and no CVE in the front of this chain. The user is the execution mechanism, which is why parent-child process telemetry and clipboard-to-process correlation matter more here than exploit detection.

Two things separate DeviceManager from a typical RAT. First, it resolves its command-and-control server from a smart contract on the Ethereum or Polygon blockchain, a technique known as EtherHiding, documented by Google Threat Intelligence Group and mapped to MITRE ATT&CK T1102.001. Because the C2 address is read from an immutable public ledger through a read-only call, there is no domain to sinkhole and no hosting provider to serve a takedown. Second, it prefers DNS tunneling for transport, appending a hardcoded microsoft.com suffix to every query so the traffic resembles legitimate Microsoft telemetry to a defender reading DNS logs.

DeviceManager was recovered alongside an updated build of CountLoader, a second payload delivered by the same DOUBLECUP infrastructure. This page focuses on DeviceManager and the DOUBLECUP delivery chain that precedes it, because the pre-execution and post-execution behavior is where realistic detection windows exist.

Why this matters for defenders: DeviceManager's kill chain resists the controls defenders usually lean on. There is no exploit at entry, the payload runs in memory, the C2 is read from an immutable public ledger, and the transport is disguised as Microsoft DNS traffic. None of the individual techniques are novel. The significance is that they combine into a backdoor that is hard to block at the network edge and offers nothing to sinkhole, which shifts the defensive burden onto endpoint behavior.

Verify before relying on this: SOCRadar analyzed a single build, identified as version 1.3, in which DNS tunneling and scheduled-task persistence were the active defaults, while the WMI event subscription and HTTP C2 modules were present but unused. Builds are per-campaign and the C2 is served dynamically from the blockchain, so treat the hashes, delivery URL, resolved C2, and smart-contract address as volatile and confirm them live before blocking.

Operational attack chain · DOUBLECUP to DeviceManager

  1. ClickFix lure

    Fake CAPTCHA on a CRM login clone injects DOUBLECUP via iframe.

  2. Clipboard hijack & PNG cache

    Browser-matched command copied to clipboard; steganographic PNG force-cached.

  3. Fileless dropper

    findstr / certutil extract code from the PNG; payload decrypted in memory using the victim's public IP.

    T1027.003T1480.001

  4. Inno Setup staging

    MicroUpdaterV1.exe extracts an embedded Python env and launches run.pyw via pythonw.exe.

    T1059.006

  5. Persistence & guardrails

    Scheduled task or WMI subscription (COM) every 10 min; CIS-locale self-delete; single-instance mutex.

    T1053.005T1546.003

  6. EtherHiding C2 resolution

    Read-only eth_call to an Ethereum / Polygon contract returns an encrypted C2 string, ChaCha20-decrypted to a DNS or HTTP endpoint.

    T1102.001

  7. Interactive control over DNS

    DNS TXT/A tunneling disguised as *.microsoft.com; CMD / PowerShell / Python task execution.

    T1071.004T1071.001

The most detectable moments sit at the two ends of this chain: the ClickFix execution moment, where a clipboard command spawns findstr or certutil against the browser cache, and the C2 activation moment, where a non-blockchain host makes Web3 RPC calls and begins high-volume DNS lookups. Between those points, execution is largely in memory, so detection should anchor on both ends rather than on the encryptor-style behavior a RAT does not exhibit.

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

DeviceManager and its DOUBLECUP delivery chain concentrate technique density in Execution, Defense Evasion, Discovery, and Command and Control. The mapping below reflects the DOUBLECUP analysis published and the ATT&CK techniques tied to each observed behavior. Because a RAT executes operator-supplied commands, several tactics are enabled downstream rather than built into the payload.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev0Initial Access2Execution5Persistence2Priv. Esc0Defense Evasion6Credential Access0Discovery5Lateral1Collection1C25Exfiltration1Impact1
Technique detailKey techniques · DeviceManager / DOUBLECUP
TacticTechniquesObserved behavior / defender telemetry
Initial Access
Malicious Copy and Paste T1204.004Spearphishing Link T1566.002
DOUBLECUP is injected into ClickFix pages that impersonate CRM login portals (NetSuite, Odoo, HubSpot, Salesforce) through embedded iframes. A fake CAPTCHA copies a browser-matched command to the clipboard and instructs the victim to paste it into the Run dialog; no exploit is used. Telemetry: RunMRU registry writes, clipboard contents preceding execution, browser history and proxy logs for the lure domain, email security logs.
Execution
Windows Command Shell T1059.003PowerShell T1059.001Python T1059.006WMI T1047Native API T1106
Stage 1 uses CMD with a wildcard-obfuscated pow?r?hell.exe to locate and extract the cached PNG. The DeviceManager core runs as Python through an embedded interpreter launched by pythonw.exe; operator tasks run through CMD, PowerShell, or Python, in memory or on disk. Native Windows APIs are called through Python ctypes rather than spawning command-line tools. Telemetry: process creation (4688) with command line, PowerShell script block logging (4104), pythonw.exe from user-writable paths, interpreter processes reading from STDIN.
Persistence
Scheduled Task T1053.005WMI Event Subscription T1546.003
DeviceManager writes an XML task definition to %TEMP%\t.xml and registers a scheduled task named MicroUpdaterV1 that re-launches the script every 10 minutes, then deletes the XML. An alternative WMI event subscription (a timer, filter, consumer, and binding named PythonApp*) is built through native COM rather than wmic.exe. Telemetry: scheduled task creation (4698), schtasks /Create ... /XML followed by rapid XML deletion, WMI __EventFilter / CommandLineEventConsumer creation without a wmic.exe parent (Sysmon 19/20/21).
Defense Evasion
Steganography T1027.003Environmental Keying T1480.001Reflective Code Loading T1620Deobfuscate / Decode T1140File Deletion T1070.004Rename Legitimate Utilities T1036.003
DOUBLECUP hides its second stage in a steganographic PNG and keys payload decryption to the victim's public IP (PBKDF2), so offline or out-of-target detonation fails. Stage 2 reflectively loads a .NET assembly in memory. DeviceManager hides its console, self-deletes on CIS-locale hosts, enforces a single-instance mutex, and removes temp artifacts. Co-payload CountLoader renames and PE-header-patches copies of system binaries. Telemetry: script block and in-memory telemetry, creation and rapid deletion of _dm_* temp files, calls to public IP-echo services before execution, renamed system binaries from user-writable paths.
Discovery
System Information T1082System Owner / User T1033Query Registry T1012Network Config T1016Security Software T1518.001
DeviceManager fingerprints the host: Machine GUID from the registry, Volume Serial via kernel32.GetVolumeInformationW, the user SID via advapi32, hostname, username, OS version and build, and architecture. It enumerates installed antivirus through the WMI Security Center, prioritizing third-party AV over Windows Defender. The delivery chain resolves the victim's public IP. Telemetry: registry reads of MachineGuid, WMI queries against root\SecurityCenter2, GetVolumeInformationW and GetComputerNameExW calls, IP-echo requests (ip-api.com).
Lateral Movement
Ingress Tool Transfer T1105
DeviceManager has no built-in worming module, but interactive CMD, PowerShell, and Python execution lets an operator stage tooling and move laterally by hand. Co-payload CountLoader carries a USB and network-share LNK-spreading command, so lateral movement should be treated as an enabled capability of the intrusion. Telemetry: interpreter processes spawned by pythonw.exe, new writes to network shares, tool downloads after C2 activation, LNK creation on removable drives.
Collection
Data from Local System T1005
Command output from executed tasks is captured, chunked, base64-encoded, and returned to the operator. Any local data reachable by the executed commands can be collected through the same channel. Telemetry: bulk file reads by interpreter processes, temporary output files, outbound query volume correlated with task execution.
Command and Control
Dead Drop Resolver T1102.001DNS T1071.004Web Protocols T1071.001Symmetric Cryptography T1573.001Ingress Tool Transfer T1105
DeviceManager resolves its live C2 from an Ethereum or Polygon smart contract through a read-only eth_call (EtherHiding), decrypts the returned string with ChaCha20, and reads the first byte to choose DNS tunneling or HTTP POST. In DNS mode it uses raw UDP sockets, splits payloads into 63-character labels, and appends microsoft.com so lookups resemble Microsoft telemetry. Telemetry: eth_call RPC to public endpoints from non-blockchain hosts, high-volume DNS TXT/A queries with long encoded labels, microsoft.com resolving to non-Microsoft infrastructure.
Exfiltration
Exfil Over Alt Protocol T1048
System information and command output are exfiltrated inside DNS queries: host details encode into TXT-record subdomains, and standard output and error are chunked, base64-encoded, and sent back label by label. The same channel doubles as transport and exfiltration. Telemetry: sustained DNS TXT volume from a single host, long base64-like labels, byte-count anomalies over UDP/53.
Impact
Remote control (downstream)
DeviceManager performs no encryption or destruction. Its impact is the interactive control it hands to an operator: credential theft, data collection, lateral movement, deployment of follow-on malware including ransomware, and resale of the foothold. Telemetry: post-compromise activity tied to the RAT process tree, new persistence beyond the RAT's own tasks, follow-on tool downloads, anomalous authentications.
Recon / Resource Dev / Priv. Esc / Credential Access—Not observed as built-in behavior. Infrastructure is provided by the DOUBLECUP loader-as-a-service. Privilege escalation and credential theft are not native to the RAT but can be performed through operator-supplied commands after execution.
Stage 1T1204.004 · T1566.002 · T1027.003 · T1480.001

How the attack starts

DeviceManager does not arrive through an exploit. It arrives through DOUBLECUP, a loader-as-a-service that operators embed into ClickFix pages. Observed campaigns impersonated CRM login portals for NetSuite, Odoo, HubSpot, and Salesforce, injecting the DOUBLECUP logic through iframes. When a victim lands on the page, a fake CAPTCHA copies a browser-specific command to the clipboard and tells the victim to paste it into the Run dialog. Because there is no vulnerability in this step, exploit-focused detection has nothing to fire on. The relevant signals are the clipboard content and the process that runs immediately after.

Behind the scenes, the page registers a session, resolves the victim's public IP through a service such as ip-api.com, and forces the browser to background-download and cache a steganographic PNG. The pasted command searches the browser cache for that PNG by its exact file size, then extracts the hidden code using standard utilities like findstr or certutil. This is why a legitimate-looking parent, the browser or the Run dialog, spawning findstr or certutil against a cache directory is worth alerting on.

The second stage is a fileless dropper built to defeat sandboxes. It fetches the host's public IPv4 address and feeds it through PBKDF2 to derive the key for a custom SHA-256 stream cipher. This is environmental keying: if the sample runs offline, in a sandbox, or from a network outside the intended target set, key derivation produces the wrong key and decryption fails, so the final payload never appears. After validating the decrypted bytes against a hardcoded hash, the stage reflectively loads the resulting assembly in memory and redirects the victim to a benign page.

Stage 2T1059.006 · T1053.005 · T1546.003 · T1106

What runs on the endpoint

DeviceManager is delivered as a Delphi-compiled Inno Setup installer, observed as MicroUpdaterV1.exe and hosted on Seagate Lyve cloud storage in the analyzed sample. On execution the installer drops a temporary clone (is-*.tmp) and re-launches itself with the Inno Setup /SL5 IPC flag, whose arguments encode the byte offset and size of an encrypted payload appended to the end of the executable.

The unpacker extracts a full embedded Python environment, including python3.dll and pythonw.exe, alongside the obfuscated core script run.pyw, into a directory under %LOCALAPPDATA%. It then launches run.pyw through pythonw.exe so there is no console window. The deobfuscated script identifies itself as version 1.3. For defenders, the durable signal is a freshly installed application spawning a bundled pythonw.exe from a user-writable path to run a .pyw script, a pattern that has almost no legitimate parallel on a standard corporate endpoint.

Persistence is established immediately. The RAT writes an XML task definition to %TEMP%\t.xml and creates a scheduled task named MicroUpdaterV1 that re-runs the script every 10 minutes, then deletes the XML in a finally block to reduce forensic residue.

Scheduled task creation (representative)
schtasks.exe /Create /F /TN "MicroUpdaterV1" /XML "%TEMP%\t.xml"

A second, redundant persistence path exists but was inactive in the analyzed configuration: a WMI event subscription built from a timer instruction, an event filter, a command-line consumer, and a filter-to-consumer binding named with a PythonApp prefix. It is worth understanding even when unused, because it is created through native COM interfaces (ole32.dll and oleaut32.dll) via Python ctypes rather than through wmic.exe. That design deliberately avoids the process-lineage rules many teams rely on to catch WMI persistence.

Stage 3T1480.001 · T1106 · T1620 · T1071.004

How the malware evades detection

Evasion in this chain is layered and starts before the RAT even runs. Environmental keying in the DOUBLECUP dropper ties payload decryption to the victim's public IP, so an analyst running the sample outside the targeted network gets nothing. When DeviceManager itself starts, it checks the UI language through GetUserDefaultUILanguage for Commonwealth of Independent States locales; on a match it deletes its scheduled task, removes its install directory, and exits. It then hides its console window and enforces single-instance execution using a mutex derived from an MD5 of the Machine GUID and Disk ID.

Wherever possible, DeviceManager interacts with Windows through native API calls made from Python ctypes instead of spawning command-line tools. The clearest example is the WMI event subscription path, provisioned through COM rather than wmic.exe, which sidesteps detections that key on WMI command-line creation. In DNS transport mode the RAT is hardcoded to execute tasks only in memory, so there is often no payload file on disk to scan.

The most defender-relevant evasion is in the network layer. Every DNS query the RAT constructs appends a hardcoded apex of microsoft.com. The queries route to the operator's authoritative server, which strips and ignores the suffix, but to an analyst reading DNS logs the traffic mimics ordinary Microsoft host telemetry. Combined with EtherHiding for C2 resolution, this means signature and PE-focused controls have little to work with. Driver-free, file-light, and blended into trusted-looking DNS, the RAT is best caught by behavioral correlation: the process that emits the queries, the volume and structure of the labels, and the fact that microsoft.com is resolving to infrastructure that is not Microsoft's.

Stage 4T1082 · T1012 · T1102.001 · T1071.004

What it tries to access or modify

Before contacting its operator, DeviceManager builds a host fingerprint. It reads the Machine GUID from HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid, extracts the volume serial number of the system drive through kernel32.GetVolumeInformationW, resolves the current user's SID through advapi32, and collects hostname, username, OS caption, build, architecture, and domain. It enumerates installed antivirus through the WMI Security Center and deliberately prioritizes reporting third-party products over Windows Defender, which tells the operator what protection is present before they act.

C2 resolution is the technically distinctive part. Rather than embedding a domain or IP that defenders can block, DeviceManager queries a smart contract on the Ethereum or Polygon blockchain through a read-only eth_call, a technique Google Threat Intelligence Group documents as EtherHiding and MITRE maps as a dead drop resolver (T1102.001). The RAT sends a device-specific hash as an argument, so the operator can return a different C2 to each victim, or a null response to a host they suspect is a sandbox. The returned string is ChaCha20-encrypted on-chain, so simply reading the contract does not expose the C2. Once decrypted, the first byte selects the channel: DNS tunneling or HTTP POST.

With the channel resolved, the RAT runs an operator's commands. It supports three interpreters, CMD, PowerShell, and Python, across in-memory and on-disk modes; in DNS mode it executes exclusively in memory. Payloads and results move through DNS records, with system information encoded into TXT-record subdomains and command output chunked and base64-encoded back to the server. From this point the RAT can access anything the executed commands can reach. The practical consequence is that a DeviceManager infection should be scoped as full interactive compromise of the host, with credential exposure, data access, and lateral movement all on the table depending on what the operator chose to run.

Execution flow

What a DeviceManager infection looks like in EDR telemetry

Where Malware Protection Plus fits

DeviceManager gives defenders obvious signs at the network level, which makes endpoint visibility the decisive advantage. Two moments expose the attack: the ClickFix execution step, where a clipboard command spawns extraction tooling against the browser cache, and the C2 activation step, where a host with no blockchain workload begins Web3 RPC lookups and high-volume DNS queries.

DeviceManager evades signature-based detection by using campaign-specific builds, decrypting its payload in memory, and executing commands through interpreters without leaving obvious files on disk. A behavior-based detection layer can instead identify the parts of the chain that are harder to disguise: a bundled pythonw.exe launched from a user-writable path with no console, a scheduled task registered from a temporary XML that is deleted moments later, a WMI event subscription created through native COM rather than wmic.exe, and DNS traffic that carries long encoded labels under a microsoft.com suffix while resolving to non-Microsoft infrastructure.

Malware Protection Plus helps security teams detect these behaviors, isolate the affected host to cut the operator off before the foothold is acted on, investigate the root cause using captured process, task, and DNS telemetry, and support remediation once a compromise involving in-memory execution and dual persistence is confirmed. Because DeviceManager exists to hand an operator long-term interactive control, monitoring persistence mechanisms such as scheduled tasks, services, and WMI subscriptions over time matters as much as any single alert.

Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Because DeviceManager builds are per-campaign and its C2 is resolved dynamically from the blockchain, hashes, IPs, and the resolved C2 rotate quickly. Prefer the behavioral and host-artifact indicators for evergreen detection, and source atomic indicators live before blocking.

Durable: process and command patterns

6 patterns

Parent-child chains and command lines that signal a DOUBLECUP-to-DeviceManager infection in progress.

  • Run dialog / browser → findstr or certutil reading browser cacheClickFix Stage 1: extract embedded code from the cached steganographic PNG
  • Inno Setup .exe → is-*.tmp → pythonw.exe run.pywEmbedded Python launched from a user-writable path with no console
  • schtasks /Create /TN "MicroUpdaterV1" /XML %TEMP%\t.xml (then t.xml deleted)Scheduled task persistence with immediate XML cleanup
  • WMI __EventFilter / CommandLineEventConsumer created with no wmic.exe parentWMI subscription persistence built via native COM (evades lineage rules)
  • eth_call to public Web3 RPC from a non-blockchain hostEtherHiding C2 resolution; RPC endpoints are randomized between calls
  • High-volume DNS TXT/A to *.microsoft.com resolving to non-Microsoft IPsDNS tunneling disguised as Microsoft telemetry; 63-character encoded labels

Durable: host artifacts

7 artifacts

File, task, and object artifacts that persist for forensic timelines. Names may vary by build, but structure is consistent.

  • %LOCALAPPDATA%\DeviceManager\ (config.json, agent.log, agent_main.pyw, agent\)Install directory, config, rotating log, and script entry point
  • Embedded Python under %LOCALAPPDATA%\...\Microsoft.PythonApp_*Bundled Python runtime dropped by the Inno Setup unpacker
  • Scheduled task: MicroUpdaterV1 (fallback: PythonAppUpdater)Re-launches the RAT every 10 minutes
  • WMI objects: PythonAppUpdateFilter / PythonAppUpdateConsumer / PythonAppTimer_600WMI event subscription components (root\subscription); fires every 600 seconds
  • %TEMP%\_dm_task.py / %TEMP%\_dm_*.ps1 / %TEMP%\_dm_*.bat_dm_-prefixed temporary task files, created and deleted per command
  • %TEMP%\t.xml (scheduled task definition, deleted after creation)Transient XML used to register the persistence task
  • Mutex derived from MD5(Machine GUID + Disk ID)Host-unique single-instance mutex

Volatile: atomic indicators (time-limited)

Volatile · expect rotation

Hashes, the delivery URL, the resolved C2, and on-chain addresses from the August 2026 DOUBLECUP analysis. Vet before blocking; builds and C2 rotate, and the C2 is served dynamically from the blockchain.

  • 6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cbaSHA-256: MicroUpdaterV1.exe (DeviceManager Inno Setup installer)
  • ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50SHA-256: run.pyw (DeviceManager core script)
  • s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exeDelivery URL for DeviceManager (abused Seagate Lyve cloud storage)
  • 91.92.240[.]100 (dns:// C2)DeviceManager C2 decoded from the smart contract at analysis time; rotates
  • 0xc027490AF56a9d7050fc259Ecd03DA1580b84aaeEtherHiding smart contract; read selector 0x1dcf296b, global write 0xc474520d

Detection guidance

Signature and hash detection is weak against DeviceManager: builds are per-campaign, execution is largely fileless, and the C2 is resolved from an immutable ledger. The reliable detections target behavior at the two ends of the chain, the ClickFix execution moment and the C2 activation moment, plus the persistence it must create in between. The detections below are ordered roughly by kill-chain position.

  1. 01

    Clipboard-to-process correlation (ClickFix)

    Endpoint / process telemetry

    Correlate clipboard contents containing shell keywords, encoded commands, or wildcard binaries (for example pow?r?hell.exe) with execution of the same command shortly afterward from the Run dialog. Watch for cmd.exe or the browser spawning findstr or certutil against a browser cache directory.

    Why it works: ClickFix turns the user into the execution mechanism, so there is no exploit to detect. The clipboard sequence and the RunMRU artifact expose the social-engineering step, and findstr or certutil reading cache files is the extraction of the staged PNG. False positives are rare on standard endpoints.

  2. 02

    Embedded Python launched from a user path

    EDR / process telemetry

    Alert on an Inno Setup installer spawning an is-*.tmp clone that in turn launches a bundled pythonw.exe to run a .pyw script from %LOCALAPPDATA% or another user-writable path, with no console window.

    Why it works: a self-contained Python runtime dropped by an installer and run headless is characteristic of this RAT and has little legitimate parallel on a managed endpoint. Scope out genuine developer machines to reduce noise.

  3. 03

    Scheduled task from a temporary XML, then deleted

    Task scheduler telemetry

    Alert on schtasks /Create ... /XML that references a file in %TEMP%, especially when that XML is deleted immediately afterward, and on task names such as MicroUpdaterV1 or PythonAppUpdater that re-run a script on a short interval.

    Why it works: registering a task from a transient XML and cleaning up the XML is a deliberate anti-forensic pattern. The 10-minute re-run interval and update-service-style naming are consistent across builds.

  4. 04

    WMI event subscription created without wmic.exe

    WMI / Sysmon telemetry

    Monitor for creation of __EventFilter, CommandLineEventConsumer, and __FilterToConsumerBinding objects (Sysmon Event IDs 19, 20, 21) where the creating process is not wmic.exe or powershell.exe. Watch for filter and consumer names with a PythonApp prefix.

    Why it works: DeviceManager builds WMI persistence through native COM specifically to defeat process-lineage rules. Detecting the resulting objects, rather than the command that would normally create them, closes that gap.

  5. 05

    Web3 RPC from non-blockchain hosts (EtherHiding)

    Network / DNS telemetry

    Alert on outbound eth_call JSON-RPC requests or connections to public Web3 RPC endpoints (Sepolia, Polygon, Ethereum) from endpoints and servers that have no blockchain workload. Treat randomized RPC endpoint selection from a single host as an amplifying signal.

    Why it works: EtherHiding resolves C2 from an immutable contract that cannot be sinkholed, but the RPC lookup itself is anomalous on a normal corporate host. This is often the first network signal that C2 resolution is underway. RPC allowlisting turns this into a high-fidelity control.

  6. 06

    DNS tunneling disguised as Microsoft telemetry

    DNS / NDR telemetry

    Alert on high-volume DNS TXT and A queries carrying long, high-entropy labels, especially lookups under microsoft.com that resolve to non-Microsoft infrastructure. Look for sustained query bursts from a single process and 63-character label chunking.

    Why it works: the hardcoded microsoft.com suffix is meant to blend in, but the volume, label structure, and the resolved IP give it away. Correlating the query source process with pythonw.exe raises confidence.

  7. 07

    In-memory task execution via STDIN

    EDR / process telemetry

    Monitor for pythonw.exe spawning cmd.exe /Q /K, powershell.exe -Command -, or a Python interpreter that receives its payload over standard input, alongside creation and rapid deletion of _dm_-prefixed temporary files.

    Why it works: DNS-mode DeviceManager executes tasks in memory by piping through STDIN, so there is often no script file to scan. The interpreter-spawned-by-pythonw pattern and the transient _dm_ files are the observable residue.

  8. 08

    Renamed system binaries from user-writable paths

    EDR / process telemetry

    Where the co-payload CountLoader is present, alert on copies of conhost.exe, powershell.exe, or mshta.exe running from user-writable directories under altered names, and on PE metadata (OriginalFilename, InternalName) that does not match the file on disk.

    Why it works: CountLoader copies, renames, and PE-header-patches system binaries to defeat simple process-name rules. Comparing on-disk name and path against embedded PE metadata exposes the masquerade.

Hardening and response recommendations

These controls target the specific dependencies of this chain: user-run clipboard commands, LOLBin abuse, embedded Python execution, and DNS or Web3 egress that carries the C2. Because DeviceManager is a hands-on backdoor, the last two items cover the response order once an infection is confirmed. Quick win = single policy or rule, deployable in days. Standard = audit-mode rollout, deployable in weeks.

  1. Train users on ClickFix and monitor the Run dialog

    Quick win

    The entire chain depends on a user pasting a command into the Run dialog after a fake CAPTCHA. Teach users that legitimate sites never ask them to paste commands to prove they are human. Monitor RunMRU registry writes and clipboard-driven execution so the social-engineering step is visible even when awareness fails.

    Focus: ClickFix and fake-CAPTCHA lures, RunMRU auditing, clipboard-to-process correlation.

  2. Restrict LOLBins used for extraction and proxy execution

    Standard

    Constrain certutil, findstr misuse against cache directories, and mshta through application control. These are the utilities the ClickFix stage uses to extract and run code from the steganographic PNG. Blocking or tightly monitoring them removes a reliable step from the chain.

    Path: AppLocker or WDAC rules and alerts on LOLBin execution with anomalous arguments and parents.

  3. Restrict execution from user-writable paths

    Standard

    Block or tightly control execution of binaries and script interpreters, including bundled pythonw.exe, from %LOCALAPPDATA%, %TEMP%, and the user profile on non-developer endpoints. DeviceManager relies on running an embedded Python runtime from exactly these locations.

    Path: WDAC or AppLocker path and publisher rules; scope Python allowances to developer machines only.

  4. Control DNS and Web3 egress

    Standard

    Force endpoints through inspected resolvers, alert on high-volume TXT queries and long encoded labels, and flag microsoft.com lookups that resolve to non-Microsoft infrastructure. Deny or allowlist outbound Web3 RPC so that eth_call traffic from a non-blockchain host is blocked or immediately visible.

    Verify: DNS logging and rate anomalies at the resolver; an egress policy that treats public RPC endpoints as non-default destinations.

  5. Harden PowerShell and audit persistence surfaces

    Quick win

    Enable PowerShell script block logging and constrained language mode where feasible, and audit scheduled-task creation (Event ID 4698) and WMI event-subscription objects. The subscription path is the one most teams miss because it is built through COM rather than wmic.exe.

    Path: Script-block logging via Group Policy; Sysmon Event IDs 19, 20, and 21 for WMI subscription auditing.

  6. Enforce phishing-resistant MFA and credential hygiene

    Quick win

    Because a RAT foothold exposes whatever the operator can reach, reduce the value of stolen credentials in advance. Enforce phishing-resistant MFA on external services, limit local admin rights, and use enterprise-managed password managers so browser-stored credentials are not the fallback the co-payload targets.

    Focus: MFA on all remote and cloud access, least privilege, managed secrets, prompt session revocation after any suspected RAT event.

  7. Respond: isolate, preserve, remove persistence, cut C2

    On detection

    Isolate the host before remediating, since in-memory tooling and the resolved C2 can still be recovered from a running system. Preserve a memory image, the %LOCALAPPDATA%\DeviceManager directory, DNS logs, and script block logs before the RAT self-cleans its _dm_ temp files. Remove both the scheduled task and any WMI event subscription, block the resolved C2 and Web3 RPC endpoints, and note that the EtherHiding contract itself cannot be taken down, so retro-hunt the device hash and RPC activity across the estate.

    Then: assume credential exposure and rotate; scope the operator's executed commands from DNS TXT logs; hunt the same ClickFix, embedded-Python, task, and subscription patterns fleet-wide before restoring.

Primary references

Source material for this page. Technical claims trace to the original DOUBLECUP research, MITRE ATT&CK technique definitions, platform threat intelligence on EtherHiding, and neutral security journalism.

Catch the DeviceManager chain at execution and at C2 activation.

Malware Protection Plus helps security teams detect suspicious endpoint behavior, isolate compromised systems, investigate root cause, and restore affected endpoints faster.

Start free trial →