# DeviceManager RAT

Remote access trojan (Python-based, modular) · Delivered by DOUBLECUP (ClickFix LaaS) · First documented August 2026

## Overview

DeviceManager is a modular, Python-based Windows remote access trojan first documented in August 2026 by SOCRadar's Threat Research Unit during analysis of a loader-as-a-service platform named DOUBLECUP. It is not a self-spreading commodity family. It is a hands-on backdoor that arrives at the end of a ClickFix social-engineering chain, gives an operator full command execution on the host, and is engineered specifically to survive infrastructure takedowns and network monitoring.

The delivery vehicle is what makes DeviceManager notable for defenders. DOUBLECUP is a Russian loader-as-a-service, active since early June 2026, that sells operators a builder and hosts the delivery infrastructure for ClickFix campaigns. It stages a steganographic PNG in the victim's browser cache, hijacks the clipboard through a fake CAPTCHA prompt, and relies on the victim to paste and run the command themselves. There is no exploit and no CVE in the front of this chain. The user is the execution mechanism, which is why parent-child process telemetry and clipboard-to-process correlation matter more here than exploit detection.

Two things separate DeviceManager from a typical RAT. First, it resolves its command-and-control server from a smart contract on the Ethereum or Polygon blockchain, a technique known as EtherHiding, [documented by Google Threat Intelligence Group](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding) and mapped to MITRE ATT&CK T1102.001. Because the C2 address is read from an immutable public ledger through a read-only call, there is no domain to sinkhole and no hosting provider to serve a takedown. Second, it prefers DNS tunneling for transport, appending a hardcoded `microsoft.com` suffix to every query so the traffic resembles legitimate Microsoft telemetry to a defender reading DNS logs.

DeviceManager was recovered alongside an updated build of CountLoader, a second payload delivered by the same DOUBLECUP infrastructure. This page focuses on DeviceManager and the DOUBLECUP delivery chain that precedes it, because the pre-execution and post-execution behavior is where realistic detection windows exist.

**Why this matters for defenders:** DeviceManager's kill chain resists the controls defenders usually lean on. There is no exploit at entry, the payload runs in memory, the C2 is read from an immutable public ledger, and the transport is disguised as Microsoft DNS traffic. None of the individual techniques are novel. The significance is that they combine into a backdoor that is hard to block at the network edge and offers nothing to sinkhole, which shifts the defensive burden onto endpoint behavior.

**Verify before relying on this:** SOCRadar analyzed a single build, identified as version 1.3, in which DNS tunneling and scheduled-task persistence were the active defaults, while the WMI event subscription and HTTP C2 modules were present but unused. Builds are per-campaign and the C2 is served dynamically from the blockchain, so treat the hashes, delivery URL, resolved C2, and smart-contract address as volatile and confirm them live before blocking.

### Threat profile

| Detail | Value |
|---|---|
| Type | Remote access trojan |
| First documented | Aug 2026 |
| Delivered by | DOUBLECUP (ClickFix LaaS) |
| Status | Active (2026) |
| Documented by | SOCRadar Threat Research Unit |
| Language | Python (embedded interpreter) · v1.3 in sample |
| Platform | Windows |
| Delivery | ClickFix · steganographic PNG · Inno Setup installer |
| Persistence | Scheduled task · WMI event subscription (COM) |
| C2 resolution | EtherHiding (Ethereum / Polygon smart contract) |
| Transport | DNS tunneling (default) · HTTP POST (unused) |
| Co-payload | CountLoader |
| Downstream risk | Credential theft · lateral movement · ransomware staging · access resale |

## Operational attack chain

### ClickFix lure

Fake CAPTCHA on a CRM login clone injects DOUBLECUP via iframe.

### Clipboard hijack and PNG cache

Browser-matched command copied to clipboard; steganographic PNG force-cached.

### Fileless dropper

`findstr` / `certutil` extract code from the PNG; payload decrypted in memory using the victim's public IP.

- T1027.003
- T1480.001

### Inno Setup staging

`MicroUpdaterV1.exe` extracts an embedded Python environment and launches `run.pyw` via `pythonw.exe`.

- T1059.006

### Persistence and guardrails

Scheduled task or WMI subscription (COM) every 10 minutes; CIS-locale self-delete; single-instance mutex.

- T1053.005
- T1546.003

### EtherHiding C2 resolution

Read-only `eth_call` to an Ethereum / Polygon contract returns an encrypted C2 string, ChaCha20-decrypted to a DNS or HTTP endpoint.

- T1102.001

### Interactive control over DNS

DNS TXT/A tunneling disguised as `*.microsoft.com`; CMD / PowerShell / Python task execution.

- T1071.004
- T1071.001

The most detectable moments sit at the two ends of this chain: the ClickFix execution moment, where a clipboard command spawns findstr or certutil against the browser cache, and the C2 activation moment, where a non-blockchain host makes Web3 RPC calls and begins high-volume DNS lookups. Between those points, execution is largely in memory, so detection should anchor on both ends rather than on the encryptor-style behavior a RAT does not exhibit.

## Tactics, techniques, and procedures

DeviceManager and its DOUBLECUP delivery chain concentrate technique density in Execution, Defense Evasion, Discovery, and Command and Control. The mapping below reflects the DOUBLECUP analysis published and the ATT&CK techniques tied to each observed behavior. Because a RAT executes operator-supplied commands, several tactics are enabled downstream rather than built into the payload.

### MITRE ATT&CK coverage

| Tactic | Coverage |
|---|---|
| Recon | Not observed (0) |
| Resource Development | Not observed (0) |
| Initial Access | Active (2) |
| Execution | Heavy (5) |
| Persistence | Active (2) |
| Privilege Escalation | Not observed (0) |
| Defense Evasion | Heavy (6) |
| Credential Access | Not observed (0) |
| Discovery | Heavy (5) |
| Lateral Movement | Active (1) |
| Collection | Active (1) |
| Command and Control | Heavy (5) |
| Exfiltration | Active (1) |
| Impact | Active (1) |

### Technique detail

| Tactic | Techniques | Observed behavior / defender telemetry |
|---|---|---|
| Initial Access | [Malicious Copy and Paste T1204.004](https://attack.mitre.org/techniques/T1204/004/); [Spearphishing Link T1566.002](https://attack.mitre.org/techniques/T1566/002/) | DOUBLECUP is injected into ClickFix pages that impersonate CRM login portals (NetSuite, Odoo, HubSpot, Salesforce) through embedded iframes. A fake CAPTCHA copies a browser-matched command to the clipboard and instructs the victim to paste it into the Run dialog; no exploit is used. Telemetry: RunMRU registry writes, clipboard contents preceding execution, browser history and proxy logs for the lure domain, email security logs. |
| Execution | [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/); [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/); [Python T1059.006](https://attack.mitre.org/techniques/T1059/006/); [WMI T1047](https://attack.mitre.org/techniques/T1047/); [Native API T1106](https://attack.mitre.org/techniques/T1106/) | Stage 1 uses CMD with a wildcard-obfuscated `pow?r?hell.exe` to locate and extract the cached PNG. The DeviceManager core runs as Python through an embedded interpreter launched by `pythonw.exe`; operator tasks run through CMD, PowerShell, or Python, in memory or on disk. Native Windows APIs are called through Python `ctypes` rather than spawning command-line tools. Telemetry: process creation (4688) with command line, PowerShell script block logging (4104), `pythonw.exe` from user-writable paths, interpreter processes reading from STDIN. |
| Persistence | [Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/); [WMI Event Subscription T1546.003](https://attack.mitre.org/techniques/T1546/003/) | DeviceManager writes an XML task definition to `%TEMP%\t.xml` and registers a scheduled task named `MicroUpdaterV1` that re-launches the script every 10 minutes, then deletes the XML. An alternative WMI event subscription (a timer, filter, consumer, and binding named `PythonApp*`) is built through native COM rather than `wmic.exe`. Telemetry: scheduled task creation (4698), `schtasks /Create ... /XML` followed by rapid XML deletion, WMI `__EventFilter` / `CommandLineEventConsumer` creation without a `wmic.exe` parent (Sysmon 19/20/21). |
| Defense Evasion | [Steganography T1027.003](https://attack.mitre.org/techniques/T1027/003/); [Environmental Keying T1480.001](https://attack.mitre.org/techniques/T1480/001/); [Reflective Code Loading T1620](https://attack.mitre.org/techniques/T1620/); [Deobfuscate / Decode T1140](https://attack.mitre.org/techniques/T1140/); [File Deletion T1070.004](https://attack.mitre.org/techniques/T1070/004/); [Rename Legitimate Utilities T1036.003](https://attack.mitre.org/techniques/T1036/003/) | DOUBLECUP hides its second stage in a steganographic PNG and keys payload decryption to the victim's public IP (PBKDF2), so offline or out-of-target detonation fails. Stage 2 reflectively loads a .NET assembly in memory. DeviceManager hides its console, self-deletes on CIS-locale hosts, enforces a single-instance mutex, and removes temp artifacts. Co-payload CountLoader renames and PE-header-patches copies of system binaries. Telemetry: script block and in-memory telemetry, creation and rapid deletion of `_dm_*` temp files, calls to public IP-echo services before execution, renamed system binaries from user-writable paths. |
| Discovery | [System Information T1082](https://attack.mitre.org/techniques/T1082/); [System Owner / User T1033](https://attack.mitre.org/techniques/T1033/); [Query Registry T1012](https://attack.mitre.org/techniques/T1012/); [Network Config T1016](https://attack.mitre.org/techniques/T1016/); [Security Software T1518.001](https://attack.mitre.org/techniques/T1518/001/) | DeviceManager fingerprints the host: Machine GUID from the registry, Volume Serial via `kernel32.GetVolumeInformationW`, the user SID via `advapi32`, hostname, username, OS version and build, and architecture. It enumerates installed antivirus through the WMI Security Center, prioritizing third-party AV over Windows Defender. The delivery chain resolves the victim's public IP. Telemetry: registry reads of `MachineGuid`, WMI queries against `root\SecurityCenter2`, `GetVolumeInformationW` and `GetComputerNameExW` calls, IP-echo requests (`ip-api.com`). |
| Lateral Movement | [Ingress Tool Transfer T1105](https://attack.mitre.org/techniques/T1105/) | DeviceManager has no built-in worming module, but interactive CMD, PowerShell, and Python execution lets an operator stage tooling and move laterally by hand. Co-payload CountLoader carries a USB and network-share LNK-spreading command, so lateral movement should be treated as an enabled capability of the intrusion. Telemetry: interpreter processes spawned by `pythonw.exe`, new writes to network shares, tool downloads after C2 activation, LNK creation on removable drives. |
| Collection | [Data from Local System T1005](https://attack.mitre.org/techniques/T1005/) | Command output from executed tasks is captured, chunked, base64-encoded, and returned to the operator. Any local data reachable by the executed commands can be collected through the same channel. Telemetry: bulk file reads by interpreter processes, temporary output files, outbound query volume correlated with task execution. |
| Command and Control | [Dead Drop Resolver T1102.001](https://attack.mitre.org/techniques/T1102/001/); [DNS T1071.004](https://attack.mitre.org/techniques/T1071/004/); [Web Protocols T1071.001](https://attack.mitre.org/techniques/T1071/001/); [Symmetric Cryptography T1573.001](https://attack.mitre.org/techniques/T1573/001/); [Ingress Tool Transfer T1105](https://attack.mitre.org/techniques/T1105/) | DeviceManager resolves its live C2 from an Ethereum or Polygon smart contract through a read-only `eth_call` (EtherHiding), decrypts the returned string with ChaCha20, and reads the first byte to choose DNS tunneling or HTTP POST. In DNS mode it uses raw UDP sockets, splits payloads into 63-character labels, and appends `microsoft.com` so lookups resemble Microsoft telemetry. Telemetry: `eth_call` RPC to public endpoints from non-blockchain hosts, high-volume DNS TXT/A queries with long encoded labels, `microsoft.com` resolving to non-Microsoft infrastructure. |
| Exfiltration | [Exfil Over Alt Protocol T1048](https://attack.mitre.org/techniques/T1048/) | System information and command output are exfiltrated inside DNS queries: host details encode into TXT-record subdomains, and standard output and error are chunked, base64-encoded, and sent back label by label. The same channel doubles as transport and exfiltration. Telemetry: sustained DNS TXT volume from a single host, long base64-like labels, byte-count anomalies over UDP/53. |
| Impact | Remote control (downstream) | DeviceManager performs no encryption or destruction. Its impact is the interactive control it hands to an operator: credential theft, data collection, lateral movement, deployment of follow-on malware including ransomware, and resale of the foothold. Telemetry: post-compromise activity tied to the RAT process tree, new persistence beyond the RAT's own tasks, follow-on tool downloads, anomalous authentications. |
| Recon / Resource Development / Privilege Escalation / Credential Access | — | Not observed as built-in behavior. Infrastructure is provided by the DOUBLECUP loader-as-a-service. Privilege escalation and credential theft are not native to the RAT but can be performed through operator-supplied commands after execution. |

### Stage 1: How the attack starts

DeviceManager does not arrive through an exploit. It arrives through DOUBLECUP, a loader-as-a-service that operators embed into ClickFix pages. Observed campaigns impersonated CRM login portals for NetSuite, Odoo, HubSpot, and Salesforce, injecting the DOUBLECUP logic through iframes. When a victim lands on the page, a fake CAPTCHA copies a browser-specific command to the clipboard and tells the victim to paste it into the Run dialog. Because there is no vulnerability in this step, exploit-focused detection has nothing to fire on. The relevant signals are the clipboard content and the process that runs immediately after.

Behind the scenes, the page registers a session, resolves the victim's public IP through a service such as ip-api.com, and forces the browser to background-download and cache a steganographic PNG. The pasted command searches the browser cache for that PNG by its exact file size, then extracts the hidden code using standard utilities like `findstr` or `certutil`. This is why a legitimate-looking parent, the browser or the Run dialog, spawning `findstr` or `certutil` against a cache directory is worth alerting on.

The second stage is a fileless dropper built to defeat sandboxes. It fetches the host's public IPv4 address and feeds it through PBKDF2 to derive the key for a custom SHA-256 stream cipher. This is environmental keying: if the sample runs offline, in a sandbox, or from a network outside the intended target set, key derivation produces the wrong key and decryption fails, so the final payload never appears. After validating the decrypted bytes against a hardcoded hash, the stage reflectively loads the resulting assembly in memory and redirects the victim to a benign page.

### Stage 2: What runs on the endpoint

DeviceManager is delivered as a Delphi-compiled Inno Setup installer, observed as `MicroUpdaterV1.exe` and hosted on Seagate Lyve cloud storage in the analyzed sample. On execution the installer drops a temporary clone (`is-*.tmp`) and re-launches itself with the Inno Setup `/SL5` IPC flag, whose arguments encode the byte offset and size of an encrypted payload appended to the end of the executable.

The unpacker extracts a full embedded Python environment, including `python3.dll` and `pythonw.exe`, alongside the obfuscated core script `run.pyw`, into a directory under `%LOCALAPPDATA%`. It then launches `run.pyw` through `pythonw.exe` so there is no console window. The deobfuscated script identifies itself as version 1.3. For defenders, the durable signal is a freshly installed application spawning a bundled `pythonw.exe` from a user-writable path to run a `.pyw` script, a pattern that has almost no legitimate parallel on a standard corporate endpoint.

Persistence is established immediately. The RAT writes an XML task definition to `%TEMP%\t.xml` and creates a scheduled task named `MicroUpdaterV1` that re-runs the script every 10 minutes, then deletes the XML in a `finally` block to reduce forensic residue.

#### Scheduled task creation (representative)

```batch
schtasks.exe /Create /F /TN "MicroUpdaterV1" /XML "%TEMP%\t.xml"
```

A second, redundant persistence path exists but was inactive in the analyzed configuration: a WMI event subscription built from a timer instruction, an event filter, a command-line consumer, and a filter-to-consumer binding named with a `PythonApp` prefix. It is worth understanding even when unused, because it is created through native COM interfaces (`ole32.dll` and `oleaut32.dll`) via Python `ctypes` rather than through `wmic.exe`. That design deliberately avoids the process-lineage rules many teams rely on to catch WMI persistence.

### Stage 3: How the malware evades detection

Evasion in this chain is layered and starts before the RAT even runs. Environmental keying in the DOUBLECUP dropper ties payload decryption to the victim's public IP, so an analyst running the sample outside the targeted network gets nothing. When DeviceManager itself starts, it checks the UI language through `GetUserDefaultUILanguage` for Commonwealth of Independent States locales; on a match it deletes its scheduled task, removes its install directory, and exits. It then hides its console window and enforces single-instance execution using a mutex derived from an MD5 of the Machine GUID and Disk ID.

Wherever possible, DeviceManager interacts with Windows through native API calls made from Python `ctypes` instead of spawning command-line tools. The clearest example is the WMI event subscription path, provisioned through COM rather than `wmic.exe`, which sidesteps detections that key on WMI command-line creation. In DNS transport mode the RAT is hardcoded to execute tasks only in memory, so there is often no payload file on disk to scan.

The most defender-relevant evasion is in the network layer. Every DNS query the RAT constructs appends a hardcoded apex of `microsoft.com`. The queries route to the operator's authoritative server, which strips and ignores the suffix, but to an analyst reading DNS logs the traffic mimics ordinary Microsoft host telemetry. Combined with EtherHiding for C2 resolution, this means signature and PE-focused controls have little to work with. Driver-free, file-light, and blended into trusted-looking DNS, the RAT is best caught by behavioral correlation: the process that emits the queries, the volume and structure of the labels, and the fact that `microsoft.com` is resolving to infrastructure that is not Microsoft's.

### Stage 4: What it tries to access or modify

Before contacting its operator, DeviceManager builds a host fingerprint. It reads the Machine GUID from `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid`, extracts the volume serial number of the system drive through `kernel32.GetVolumeInformationW`, resolves the current user's SID through `advapi32`, and collects hostname, username, OS caption, build, architecture, and domain. It enumerates installed antivirus through the WMI Security Center and deliberately prioritizes reporting third-party products over Windows Defender, which tells the operator what protection is present before they act.

C2 resolution is the technically distinctive part. Rather than embedding a domain or IP that defenders can block, DeviceManager queries a smart contract on the Ethereum or Polygon blockchain through a read-only `eth_call`, a technique Google Threat Intelligence Group documents as EtherHiding and MITRE maps as a dead drop resolver (T1102.001). The RAT sends a device-specific hash as an argument, so the operator can return a different C2 to each victim, or a null response to a host they suspect is a sandbox. The returned string is ChaCha20-encrypted on-chain, so simply reading the contract does not expose the C2. Once decrypted, the first byte selects the channel: DNS tunneling or HTTP POST.

With the channel resolved, the RAT runs an operator's commands. It supports three interpreters, CMD, PowerShell, and Python, across in-memory and on-disk modes; in DNS mode it executes exclusively in memory. Payloads and results move through DNS records, with system information encoded into TXT-record subdomains and command output chunked and base64-encoded back to the server. From this point the RAT can access anything the executed commands can reach. The practical consequence is that a DeviceManager infection should be scoped as full interactive compromise of the host, with credential exposure, data access, and lateral movement all on the table depending on what the operator chose to run.

### Execution flow

#### What a DeviceManager infection looks like in EDR telemetry

```text
msedge.exe / chrome.exe
// ClickFix page: clipboard hijacked with browser-matched command

cmd.exe [PID 4120]                                   ClickFix paste · T1204.004
└─ findstr.exe "ZZ1984" "…\Edge\User Data\…\f_0000xx" Extract from cached PNG · T1027.003
└─ powershell.exe -NoP -W Hidden -EP B               Stage 2 dropper · IP-keyed · T1480.001

MicroUpdaterV1.exe [PID 5330]
// Inno Setup installer
└─ is-DWA04JDXUI.tmp /SL5="$XXXXX,10201996,893952,…" // unpacks embedded Python
   └─ pythonw.exe run.pyw                            DeviceManager core v1.3 · T1059.006

└─ schtasks.exe /Create /F /TN "MicroUpdaterV1" /XML %TEMP%\t.xml
                                                     Persistence · T1053.005
└─ [ctypes → ole32.dll / oleaut32.dll]               WMI event subscription via COM (no wmic.exe) · T1546.003
└─ [eth_call → Sepolia / Polygon RPC]                EtherHiding C2 resolution · T1102.001
└─ [DNS TXT/A → *.microsoft.com]                     Resolves to attacker infrastructure; DNS tunneling · T1071.004
   └─ cmd.exe /Q /K · powershell -Command - · pythonw
                                                     In-memory task execution via STDIN
```

## Where Malware Protection Plus fits

DeviceManager gives defenders obvious signs at the network level, which makes endpoint visibility the decisive advantage. Two moments expose the attack: the ClickFix execution step, where a clipboard command spawns extraction tooling against the browser cache, and the C2 activation step, where a host with no blockchain workload begins Web3 RPC lookups and high-volume DNS queries.

DeviceManager evades signature-based detection by using campaign-specific builds, decrypting its payload in memory, and executing commands through interpreters without leaving obvious files on disk. A behavior-based detection layer can instead identify the parts of the chain that are harder to disguise: a bundled `pythonw.exe` launched from a user-writable path with no console, a scheduled task registered from a temporary XML that is deleted moments later, a WMI event subscription created through native COM rather than `wmic.exe`, and DNS traffic that carries long encoded labels under a `microsoft.com` suffix while resolving to non-Microsoft infrastructure.

[Malware Protection Plus](https://www.manageengine.com/malware-protection/) helps security teams detect these behaviors, isolate the affected host to cut the operator off before the foothold is acted on, investigate the root cause using captured process, task, and DNS telemetry, and support remediation once a compromise involving in-memory execution and dual persistence is confirmed. Because DeviceManager exists to hand an operator long-term interactive control, monitoring persistence mechanisms such as scheduled tasks, services, and WMI subscriptions over time matters as much as any single alert.

## Indicators of compromise

Durable behavioral indicators are separated from volatile artifacts. Because DeviceManager builds are per-campaign and its C2 is resolved dynamically from the blockchain, hashes, IPs, and the resolved C2 rotate quickly. Prefer the behavioral and host-artifact indicators for evergreen detection, and source atomic indicators live before blocking.

### Durable: process and command patterns

Parent-child chains and command lines that signal a DOUBLECUP-to-DeviceManager infection in progress.

- `Run dialog / browser → findstr or certutil reading browser cache`
  - ClickFix Stage 1: extract embedded code from the cached steganographic PNG.
- `Inno Setup .exe → is-*.tmp → pythonw.exe run.pyw`
  - Embedded Python launched from a user-writable path with no console.
- `schtasks /Create /TN "MicroUpdaterV1" /XML %TEMP%\t.xml (then t.xml deleted)`
  - Scheduled task persistence with immediate XML cleanup.
- `WMI __EventFilter / CommandLineEventConsumer created with no wmic.exe parent`
  - WMI subscription persistence built via native COM (evades lineage rules).
- `eth_call to public Web3 RPC from a non-blockchain host`
  - EtherHiding C2 resolution; RPC endpoints are randomized between calls.
- `High-volume DNS TXT/A to *.microsoft.com resolving to non-Microsoft IPs`
  - DNS tunneling disguised as Microsoft telemetry; 63-character encoded labels.

### Durable: host artifacts

File, task, and object artifacts that persist for forensic timelines. Names may vary by build, but structure is consistent.

- `%LOCALAPPDATA%\DeviceManager\ (config.json, agent.log, agent_main.pyw, agent\)`
  - Install directory, config, rotating log, and script entry point.
- `Embedded Python under %LOCALAPPDATA%\...\Microsoft.PythonApp_*`
  - Bundled Python runtime dropped by the Inno Setup unpacker.
- `Scheduled task: MicroUpdaterV1 (fallback: PythonAppUpdater)`
  - Re-launches the RAT every 10 minutes.
- `WMI objects: PythonAppUpdateFilter / PythonAppUpdateConsumer / PythonAppTimer_600`
  - WMI event subscription components (`root\subscription`); fires every 600 seconds.
- `%TEMP%\_dm_task.py / %TEMP%\_dm_*.ps1 / %TEMP%\_dm_*.bat`
  - `_dm_`-prefixed temporary task files, created and deleted per command.
- `%TEMP%\t.xml (scheduled task definition, deleted after creation)`
  - Transient XML used to register the persistence task.
- `Mutex derived from MD5(Machine GUID + Disk ID)`
  - Host-unique single-instance mutex.

### Volatile: atomic indicators (time-limited)

Hashes, the delivery URL, the resolved C2, and on-chain addresses from the August 2026 DOUBLECUP analysis. Vet before blocking; builds and C2 rotate, and the C2 is served dynamically from the blockchain.

- `6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba`
  - SHA-256: MicroUpdaterV1.exe (DeviceManager Inno Setup installer).
- `ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50`
  - SHA-256: run.pyw (DeviceManager core script).
- `s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe`
  - Delivery URL for DeviceManager (abused Seagate Lyve cloud storage).
- `91.92.240[.]100 (dns:// C2)`
  - DeviceManager C2 decoded from the smart contract at analysis time; rotates.
- `0xc027490AF56a9d7050fc259Ecd03DA1580b84aae`
  - EtherHiding smart contract; read selector `0x1dcf296b`, global write `0xc474520d`.

## Detection guidance

Signature and hash detection is weak against DeviceManager: builds are per-campaign, execution is largely fileless, and the C2 is resolved from an immutable ledger. The reliable detections target behavior at the two ends of the chain, the ClickFix execution moment and the C2 activation moment, plus the persistence it must create in between. The detections below are ordered roughly by kill-chain position.

### 1. Clipboard-to-process correlation (ClickFix)

**Endpoint / process telemetry**

Correlate clipboard contents containing shell keywords, encoded commands, or wildcard binaries (for example `pow?r?hell.exe`) with execution of the same command shortly afterward from the Run dialog. Watch for `cmd.exe` or the browser spawning `findstr` or `certutil` against a browser cache directory.

**Why it works:** ClickFix turns the user into the execution mechanism, so there is no exploit to detect. The clipboard sequence and the RunMRU artifact expose the social-engineering step, and `findstr` or `certutil` reading cache files is the extraction of the staged PNG. False positives are rare on standard endpoints.

### 2. Embedded Python launched from a user path

**EDR / process telemetry**

Alert on an Inno Setup installer spawning an `is-*.tmp` clone that in turn launches a bundled `pythonw.exe` to run a `.pyw` script from `%LOCALAPPDATA%` or another user-writable path, with no console window.

**Why it works:** A self-contained Python runtime dropped by an installer and run headless is characteristic of this RAT and has little legitimate parallel on a managed endpoint. Scope out genuine developer machines to reduce noise.

### 3. Scheduled task from a temporary XML, then deleted

**Task scheduler telemetry**

Alert on `schtasks /Create ... /XML` that references a file in `%TEMP%`, especially when that XML is deleted immediately afterward, and on task names such as `MicroUpdaterV1` or `PythonAppUpdater` that re-run a script on a short interval.

**Why it works:** Registering a task from a transient XML and cleaning up the XML is a deliberate anti-forensic pattern. The 10-minute re-run interval and update-service-style naming are consistent across builds.

### 4. WMI event subscription created without wmic.exe

**WMI / Sysmon telemetry**

Monitor for creation of `__EventFilter`, `CommandLineEventConsumer`, and `__FilterToConsumerBinding` objects (Sysmon Event IDs 19, 20, 21) where the creating process is not `wmic.exe` or `powershell.exe`. Watch for filter and consumer names with a `PythonApp` prefix.

**Why it works:** DeviceManager builds WMI persistence through native COM specifically to defeat process-lineage rules. Detecting the resulting objects, rather than the command that would normally create them, closes that gap.

### 5. Web3 RPC from non-blockchain hosts (EtherHiding)

**Network / DNS telemetry**

Alert on outbound `eth_call` JSON-RPC requests or connections to public Web3 RPC endpoints (Sepolia, Polygon, Ethereum) from endpoints and servers that have no blockchain workload. Treat randomized RPC endpoint selection from a single host as an amplifying signal.

**Why it works:** EtherHiding resolves C2 from an immutable contract that cannot be sinkholed, but the RPC lookup itself is anomalous on a normal corporate host. This is often the first network signal that C2 resolution is underway. RPC allowlisting turns this into a high-fidelity control.

### 6. DNS tunneling disguised as Microsoft telemetry

**DNS / NDR telemetry**

Alert on high-volume DNS TXT and A queries carrying long, high-entropy labels, especially lookups under `microsoft.com` that resolve to non-Microsoft infrastructure. Look for sustained query bursts from a single process and 63-character label chunking.

**Why it works:** The hardcoded `microsoft.com` suffix is meant to blend in, but the volume, label structure, and the resolved IP give it away. Correlating the query source process with `pythonw.exe` raises confidence.

### 7. In-memory task execution via STDIN

**EDR / process telemetry**

Monitor for `pythonw.exe` spawning `cmd.exe /Q /K`, `powershell.exe -Command -`, or a Python interpreter that receives its payload over standard input, alongside creation and rapid deletion of `_dm_`-prefixed temporary files.

**Why it works:** DNS-mode DeviceManager executes tasks in memory by piping through STDIN, so there is often no script file to scan. The interpreter-spawned-by-pythonw pattern and the transient `_dm_` files are the observable residue.

### 8. Renamed system binaries from user-writable paths

**EDR / process telemetry**

Where the co-payload CountLoader is present, alert on copies of `conhost.exe`, `powershell.exe`, or `mshta.exe` running from user-writable directories under altered names, and on PE metadata (OriginalFilename, InternalName) that does not match the file on disk.

**Why it works:** CountLoader copies, renames, and PE-header-patches system binaries to defeat simple process-name rules. Comparing on-disk name and path against embedded PE metadata exposes the masquerade.

Detections 01 and 02 fire at execution, before persistence and C2 are established, and are the highest-value window. Detections 05 and 06 catch the threat at C2 activation, when there is still time to isolate the host before an operator acts. Static hashes will lag every new build, so behavioral coverage across these stages matters more than any single indicator.

## Hardening and response recommendations

These controls target the specific dependencies of this chain: user-run clipboard commands, LOLBin abuse, embedded Python execution, and DNS or Web3 egress that carries the C2. Because DeviceManager is a hands-on backdoor, the last two items cover the response order once an infection is confirmed. **Quick win** = single policy or rule, deployable in days. **Standard** = audit-mode rollout, deployable in weeks.

### 1. Train users on ClickFix and monitor the Run dialog

**Quick win**

The entire chain depends on a user pasting a command into the Run dialog after a fake CAPTCHA. Teach users that legitimate sites never ask them to paste commands to prove they are human. Monitor RunMRU registry writes and clipboard-driven execution so the social-engineering step is visible even when awareness fails.

**Focus:** ClickFix and fake-CAPTCHA lures, RunMRU auditing, clipboard-to-process correlation.

### 2. Restrict LOLBins used for extraction and proxy execution

**Standard**

Constrain `certutil`, `findstr` misuse against cache directories, and `mshta` through application control. These are the utilities the ClickFix stage uses to extract and run code from the steganographic PNG. Blocking or tightly monitoring them removes a reliable step from the chain.

**Path:** AppLocker or WDAC rules and alerts on LOLBin execution with anomalous arguments and parents.

### 3. Restrict execution from user-writable paths

**Standard**

Block or tightly control execution of binaries and script interpreters, including bundled `pythonw.exe`, from `%LOCALAPPDATA%`, `%TEMP%`, and the user profile on non-developer endpoints. DeviceManager relies on running an embedded Python runtime from exactly these locations.

**Path:** WDAC or AppLocker path and publisher rules; scope Python allowances to developer machines only.

### 4. Control DNS and Web3 egress

**Standard**

Force endpoints through inspected resolvers, alert on high-volume TXT queries and long encoded labels, and flag `microsoft.com` lookups that resolve to non-Microsoft infrastructure. Deny or allowlist outbound Web3 RPC so that `eth_call` traffic from a non-blockchain host is blocked or immediately visible.

**Verify:** DNS logging and rate anomalies at the resolver; an egress policy that treats public RPC endpoints as non-default destinations.

### 5. Harden PowerShell and audit persistence surfaces

**Quick win**

Enable PowerShell script block logging and constrained language mode where feasible, and audit scheduled-task creation (Event ID 4698) and WMI event-subscription objects. The subscription path is the one most teams miss because it is built through COM rather than `wmic.exe`.

**Path:** Script-block logging via Group Policy; Sysmon Event IDs 19, 20, and 21 for WMI subscription auditing.

### 6. Enforce phishing-resistant MFA and credential hygiene

**Quick win**

Because a RAT foothold exposes whatever the operator can reach, reduce the value of stolen credentials in advance. Enforce phishing-resistant MFA on external services, limit local admin rights, and use enterprise-managed password managers so browser-stored credentials are not the fallback the co-payload targets.

**Focus:** MFA on all remote and cloud access, least privilege, managed secrets, prompt session revocation after any suspected RAT event.

### 7. Respond: isolate, preserve, remove persistence, cut C2

**On detection**

Isolate the host before remediating, since in-memory tooling and the resolved C2 can still be recovered from a running system. Preserve a memory image, the `%LOCALAPPDATA%\DeviceManager` directory, DNS logs, and script block logs before the RAT self-cleans its `_dm_` temp files. Remove both the scheduled task and any WMI event subscription, block the resolved C2 and Web3 RPC endpoints, and note that the EtherHiding contract itself cannot be taken down, so retro-hunt the device hash and RPC activity across the estate.

**Then:** Assume credential exposure and rotate; scope the operator's executed commands from DNS TXT logs; hunt the same ClickFix, embedded-Python, task, and subscription patterns fleet-wide before restoring.

Controls 1 through 3 attack the execution stage, the cheapest place to break this chain. Control 4 removes the covert C2 and exfiltration channel. Controls 5 and 6 blunt persistence and downstream credential abuse. Control 7 is the response order once an infection is confirmed. None replace behavioral detection, because operator-supplied commands vary by intrusion and the C2 cannot be blocked at the source.

## Primary references

- [SOCRadar Threat Research Unit — Introducing DOUBLECUP, a ClickFix loader delivering CountLoader and DeviceManager RATs (origin research, IOCs, MITRE mapping)](https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/) — Aug 2026
- [MITRE ATT&CK — Enterprise framework (T1204.004, T1102.001, T1071.004, T1546.003, T1480.001, T1620, T1036.003)](https://attack.mitre.org/) — Current
- [Google Threat Intelligence Group — EtherHiding: nation-state malware hiding on blockchains (technique background)](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding) — Oct 2025
- [The Hacker News — DOUBLECUP uses ClickFix and cached PNGs to deliver CountLoader and DeviceManager RAT](https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html) — Aug 2026
- [BleepingComputer — New DOUBLECUP ClickFix service hides malware in browser cache images](https://www.bleepingcomputer.com/news/security/new-doublecup-clickfix-service-hides-malware-in-browser-cache-images/) — Aug 2026