# ClearFake WebDAV Delivers Stealers & RATs to Ukrainian Gov

> ClearFake WebDAV infection chain leverages Cloudflare Workers and BNB Smart Chain to deploy Amatera stealer, ZigCryptoStealer, and NetSupport Manager.

- Published: 2026-09-08T12:29:05.000Z
- Severity: high
- Category: Malware
- Tags: Credential Theft, Cryptocurrency Theft, ClearFake, WebDAV, Amatera Stealer
- Author: Runtime Rebel Intel
- Primary source: https://blog.talosintelligence.com/clearfake-webdav-infection-chain/
- Canonical: https://runtimerebel.com/blog/clearfake-webdav-delivers-stealers-rats-to-ukrainian-gov

## Key points

- Immediate impact: Cybercriminals deploy Amatera and ZigCryptoStealer, compromising credentials and cryptocurrency wallets.
- Affected systems: Users interacting with compromised websites via Cloudflare Workers and WebDAV execution.
- Remediation: Enhance endpoint detection and response capabilities to detect malicious DLL execution.

## ClearFake WebDAV Infection Chain Leverages Cloudflare Workers for Stealer Deployment

Runtime Rebel is tracking a sophisticated `ClearFake WebDAV infection chain` that is actively deploying a variety of [malware](/glossary#malware), including the Amatera stealer, ZigCryptoStealer, and unauthorized instances of NetSupport Manager. This multi-stage attack utilizes malicious Cloudflare Workers and the BNB Smart Chain for command and control ([C2](/glossary#c2)) infrastructure, demonstrating a growing trend of adversaries exploiting decentralized platforms for stealth and resilience. The campaign was initially detected in April 2026, targeting a Ukrainian government organization, and has since revealed a broader operation focused on cryptocurrency and credentials theft, as detailed by [Cisco Talos](https://blog.talosintelligence.com/clearfake-webdav-infection-chain/).

### Technical Analysis of the ClearFake WebDAV Chain

The investigation began following the observation of a DLL named "verification.google" executing from a WebDAV UNC path within a Ukrainian government organization's telemetry in April 2026. This initial lead uncovered two parallel infection chains, both leveraging WebDAV for malicious DLL execution via `rundll32.exe`. While the initial trigger for the "verification.google" execution remains unconfirmed, Talos successfully reconstructed the `pf.ch` loader's full delivery sequence, which is assessed to be highly similar to the former.

The `pf.ch` branch typically initiates from a compromised website, where a malicious Cloudflare Worker injects JavaScript code. This JavaScript then queries a BNB Smart Chain testnet contract (0x886d310Ac23e05EA705e24E513D19f53793832A9) to retrieve the next stage [payload](/glossary#payload). This technique, known as EtherHiding, uses the public blockchain as a bulletproof hosting provider for malicious code. Depending on the victim's operating system, the JavaScript then presents a fake Google CAPTCHA or ClickFix prompt, tricking users into downloading and executing the Amatera stealer.

### Amatera Stealer and Secondary Payloads

The Amatera stealer serves as the primary payload across both identified infection branches. However, the secondary payloads deployed vary based on the specific C2 infrastructure used:

*   **`pf.ch` branch**: The Amatera configuration instructs the download of a DLL side-loading package, which utilizes a signed Chrome component to sideload a malicious NativeAOT DLL (`secur32.dll`). This DLL then deploys `ZigCryptoStealer` and incorporates a vulnerable driver to terminate [endpoint](/glossary#endpoint) detection and response ([EDR](/glossary#edr)) software. Additionally, a Go-based reverse TCP proxy is deployed as a secondary payload, enhancing attacker control and [persistence](/glossary#persistence).
*   **`verification.google` branch**: This branch, tracked by Talos as involving UAT-10820, delivers a PowerShell script designed to install an unauthorized instance of NetSupport Manager. The installed `NetSupport Manager` remote access tool was configured to communicate with a C2 server using a Russian IP address. Talos assesses with moderate confidence that the `verification.google` attack branch was conducted by a Russian [threat actor](/glossary#threat-actor).

### Prioritizing `Amatera stealer detection` and Mitigation

Organizations, particularly those in critical sectors, must prioritize immediate and comprehensive actions to counter this threat. The use of WebDAV for initial execution, coupled with [social engineering](/glossary#social-engineering) tactics via fake CAPTCHAs, highlights the need for a multi-layered defense strategy.

#### Actionable Recommendations:

*   **Enhance Endpoint Detection and Response (EDR)**: Implement and configure EDR solutions to detect anomalous WebDAV activity, unusual DLL execution (especially via `rundll32.exe`), and the loading of known malicious DLLs like `secur32.dll`. Focus on behavioral detection for process injection and EDR termination attempts.
*   **Implement [Network Segmentation](/glossary#network-segmentation) and Filtering**: Block outbound connections to known malicious C2 infrastructure and monitor for connections to unusual or suspicious IP addresses, particularly those associated with `NetSupport Manager C2 mitigation` efforts.
*   **User Awareness Training**: Conduct regular [security awareness training](/glossary#security-awareness-training) to educate users about social engineering tactics, including fake CAPTCHA prompts and unsolicited software downloads. Emphasize verification of download sources and caution against executing untrusted files.
*   **Application Whitelisting**: Restrict unauthorized applications from running on endpoints. This can help prevent the execution of malicious DLLs and unauthorized remote access tools like NetSupport Manager.
*   **Multi-Factor Authentication ([MFA](/glossary#mfa))**: Enforce MFA across all services, especially for accounts with access to sensitive data or cryptocurrency wallets, to mitigate the impact of stolen credentials.
*   **Monitor Cloudflare Workers**: Organizations using Cloudflare Workers should regularly review their configurations for any unauthorized or suspicious scripts that could be injecting malicious JavaScript into web content.

While the primary goal of this campaign appears to be financial gain through cryptocurrency and [credential theft](/glossary#credential-theft), the involvement of a suspected Russian threat actor in one branch targeting a Ukrainian government entity underscores the broader geopolitical implications and the evolving nature of cyber warfare. Continuous vigilance and proactive defense measures are essential.

**Related:** [Chinese-Speaking Operators Target Philippine Nuclear and Naval Assets](/blog/chinese-speaking-operators-target-philippine-nuclear-and-naval-assets), [UAT-11795 Deploys Starland RAT & WLDR Agent in Financial Campaign](/blog/uat-11795-deploys-starland-rat-wldr-agent-in-financial-campaign)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/clearfake-webdav-delivers-stealers-rats-to-ukrainian-gov