Table of Contents
A single click on a fake verification box can hand cybercriminals total control of your enterprise network.
The Lumu Cyber Threat Intelligence (CTI) team detected a new campaign that evolves the ClickFix vector into a full-scale network invasion. Dubbed Operation Device Manager, this cybercriminal operation deploys an eight-stage infection flow powered by two independent payload chains.
Victims see a fake CAPTCHA blocking site content on compromised WordPress pages. Tricked into proving they are not robots, users copy and paste a command into their terminal, unknowingly launching the attack.
From there, the infection escalates fast. The initial command disables Windows security controls, drops a 1.7 MB fileless binary straight into memory, and establishes a hidden desktop session on the victim’s endpoint. The end goal? Deploying CastleRAT (also tracked as NightshadeC2) to exfiltrate critical credentials and crypto assets.
Download the full technical report at the end of this blog.
Quick Facts: Operation Device Manager Analysis
|
How Does Operation Device Manager Compromise WordPress Sites and Bypass AMSI?
Operation Device Manager compromises WordPress sites by injecting malicious scripts that impersonate Google Tag Manager and direct victims to a fake Cloudflare verification page. Once executed, the initial PowerShell command neutralizes Windows security controls, allowing subsequent payloads to run undetected in memory.
The Lumu CTI team mapped this operation across eight distinct execution stages:
- WordPress Script Injection: Injects malicious JavaScript into tags on vulnerable high-traffic WordPress sites.
- ClickFix Social Engineering: Spoofs Google Tag Manager to display a fake Cloudflare CAPTCHA challenge.
- Terminal Command Execution: Tricks the victim into manually pasting and executing a PowerShell command.
- AMSI & Defense Bypass: Loads a stage-one dropper into memory to patch AMSI and disable internal certificate checks.
- Decentralized C2 Resolution: Queries an Ethereum smart contract to extract encoded IP data for DNS tunneling.
- Reconnaissance Exfiltration: Collects system telemetry and Active Directory environment details to qualify the host.
- Local Dynamic Compilation: Downloads a signed Python package to compile custom C binaries locally on the target system.
- CastleRAT Payload Execution: Deploys CastleRAT to establish persistent access and exfiltrate browser credentials and crypto wallets.
The campaign operates without a specific industry target, opportunistically hitting vulnerable WordPress sites characterized by high traffic volume. Researchers have identified approximately 180 compromised sites to date. The embedded script calls an external tracking domain (http[:]//(victimID).mospoqkzvk[.]com) to identify each host across these stages.
By neutralizing AMSI in stage four, the malware prevents the operating system from reporting malicious script activity to Endpoint Detection and Response (EDR) solutions. The remainder of the attack executes filelessly in memory.
How Does CastleRAT Abuse Ethereum and Steam for Command and Control?
CastleRAT maintains resilient Command and Control (C2) communication by abusing legitimate, high-reputation platforms like Ethereum and Steam to resolve C2 IP addresses without hardcoding domains. This strategy, known as Living off Trusted Sites (LotS), disguises malicious queries within standard web traffic.
Attackers deploy Ethereum smart contracts to serve as a decentralized lookup system. The initial payload queries a pre-deployed smart contract, receiving a 14-byte encoded string. Decrypting this string reveals the attacker’s direct C2 IP address (91.92.240.100:53) over a UDP socket.
To hide this network connection, the malware appends .microsoft.com to every request. This tactic spoofs legitimate Microsoft traffic, bypassing real-time inspection and polluting forensic network logs. Because the attacker controls the authoritative DNS server, the server ignores the domain and sends back covert operational commands using DNS TXT records (C2 over DNS).
In later stages, the malware switches to a second LoTS vector: the Steam community platform. The agent acts as a Dead Drop Resolver by requesting specific public Steam user profiles (id/oviudneofhs983r).
Using regular expressions (regex), the malware scans the HTML header tag of the profile name to extract a hidden IP address. Because enterprises trust Steam domain infrastructure, standard security blocklists fail to flag these C2 connections.
How Does CastleRAT Achieve In-Memory Polymorphism to Evade Detection?
CastleRAT achieves in-memory polymorphism (generating unique code structures in system memory so no two infections look identical) by compiling C-based binaries locally on the victim’s machine using a legitimate, digitally signed Python environment. This approach alters the software binary structure during every infection, rendering traditional file-hash Indicators of Compromise (IoCs) obsolete upon delivery.
Based on system telemetry collected during initial reconnaissance, the agent downloads a compressed package (http[:]//whitecarkiario[.]com/Smoke/Python[.]zip). This container houses a standalone Python environment along with an encrypted archive that the malware decrypts at runtime.
The decrypted archive contains customized Python scripts and C source code (.c). The agent compiles these components locally using the embedded compiler.
This dynamic packaging model yields critical defense evasion capabilities:
- Unique Executable Hashes: Local compilation creates a distinct binary hash for every victim, frustrating signature-based antivirus solutions.
- Rapid Re-obfuscation Pipeline: Attackers run an automated CI/CD pipeline that re-obfuscates the initial loader on every single download.
- Fresh Cryptographic Keys: The malware regenerates RC4 encryption keys individually for each victim download.
By building unique executables at execution time, attackers ensure static file signatures fail to detect incoming intrusions.
What Data Does CastleRAT Target and Who Is Behind TAG-150?
CastleRAT targets cryptocurrency assets, browser extension credentials, and session cookies, and is operated by TAG-150, a Russian-speaking Malware-as-a-Service (MaaS) provider.
The malware executes credential theft across three primary vectors:
- Desktop Crypto Wallets: The malware searches system directories to extract private keys and seed phrases from eight major wallet applications, including Exodus, Atomic, Electrum, Coinomi, and Wasabi Wallet.
- Browser Extension Credentials: Instead of relying on static lists, the agent inspects browser configuration files to dynamically identify and extract data from active crypto management extensions.
- System Passwords and Cookies: The malware avoids complex decryption routines by abusing native Windows Data Protection API (DPAPI) calls within the victim’s active session, forcing the operating system to decrypt stored credentials directly.
Threat intelligence links CastleRAT to TAG-150, an operational MaaS group active since mid-2025. Technical evidence points to Russian-speaking actors, as the malware contains explicit geographic exclusion code that aborts execution on systems using Russian, Ukrainian, Belarusian, Kazakh, or other Commonwealth of Independent States (CIS) language layouts.
Telemetry confirms an opportunistic distribution model focusing heavily on LATAM regions, with top target concentrations in Brazil, Colombia, and Argentina across sixteen commercial sectors.
How Does Operation Device Manager Map to the MITRE ATT&CK Framework?
Operation Device Manager maps across eleven MITRE ATT&CK tactics using fifty-two distinct techniques, with thirty-five of these uniquely detailing the adversary’s pre-compromise infrastructure and final exfiltration phases.
The curated matrix below highlights the most novel operational techniques driving this campaign.
| Tactic | Technique Name | Technique ID | Operational Use in Campaign |
| Initial Access | Drive-by Compromise | T1189 | Compromises legitimate WordPress websites to deliver injected script libraries. |
| Execution | User Execution: Malicious Copy and Paste | T1204.004 | Tricks victims into executing terminal commands via fake ClickFix verification prompts. |
| Defense Impairment | Disable or Modify Tools | T1685 | Patches system memory to neutralize Windows Antimalware Scan Interface (AMSI) detection. |
| Stealth | Polymorphic Code | T1027.014 | Generates unique binary hashes on every target endpoint to evade signature inspection. |
| Stealth | Compile After Delivery | T1027.004 | Builds executable modules locally using a digitally signed, embedded Python environment. |
| Command & Control | Web Service: Dead Drop Resolver | T1102.001 | Abuses Steam public profile header tags and Ethereum smart contracts to extract hidden C2 addresses. |
| Command & Control | Application Layer Protocol: DNS | T1071.004 | Establishes C2 over DNS by sending encrypted TXT queries using authoritative server infrastructure. |
| Command & Control | Data Obfuscation: Protocol Impersonation | T1001.003 | Appends .microsoft.com to DNS queries to camouflage C2 traffic as legitimate Microsoft traffic. |
| Credential Access | Credentials from Web Browsers | T1555.003 | Inspects browser configuration files dynamically to pull crypto extension wallet keys. |
| Credential Access | Steal Web Session Cookie | T1539 | Abuses native DPAPI system calls within active user sessions to extract unencrypted browser cookies. |
What Are the Key Indicators of Compromise (IoCs) for Operation Device Manager?
The Indicators of Compromise (IoCs) below detail the active network infrastructure, payload hashes, and covert dead-drop locations used in Operation Device Manager.
High-Value Infrastructure & C2 Channels
- Agent C2 (UDP/53): 91.92.240.100:53
- High-Value C2 Domains & IPs: toomuchsmokee[.]com, whitecarkiario[.]com, 45.155.249.251:1010, 2[.]27[.]160[.]121
- Delivery Chain Domains: mospoqkzvk[.]com, bernovoka[.]com, katalizatorotzhigi[.]com, mamglaqwek[.]com
- Blockchain Dead-Drop Contract: 0x5dbadd2e1be28f6142ebff9778c82603e81bae68Steam
- Dead-Drop Profile: [steamcommunity.com/id/oviudneofhs983r](https://steamcommunity.com/id/oviudneofhs983r
- Cloud Storage Repository: pub-1f5a501a59d74a6a97e77126cf1fc526.r2.dev
Critical Payload Hashes (SHA-256)
- Decrypted Agent Dropper: 7d269fe0acc75438d254b946ef8b55657f30b9de91d3d17db90c9e9a0401ab70
- Decrypted CastleRAT Payload (Variant 1): 73657e9ec16c836b2358d1734c3e43cea40537b9af33e6786ab2fca05cc5a2c3
- Decrypted CastleRAT Payload (Variant 2): eb13170c60313e0c2d8fdc4100ee17303f82c815031ff92b249210eb3d62a1ce
- Python Runtime Environment (LearnWfriend.zip): ae3a8c4824476eb60e77434d0b7eb37e3838264e077e2245a23bf1c74732894e
What Does Operation Device Manager Mean for Enterprise Defenders?
The Operation Device Manager shift highlights a broader reality in threat actor tradecraft: adversaries constantly leverage legitimate cloud services and local environment compilers to outflank perimeter security controls. Because this campaign generates unique polymorphic binaries and dynamic C2 infrastructure for every victim, static file hashes become obsolete the moment an attack begins.
For Security Operations Center teams and IT leadership, defending against Living off Trusted Sites (LoTS) requires a fundamental shift in operational strategy:
- Monitor Unapproved Script Runtimes: Flag newly installed developer tools and runtimes like deno.exe, python.exe, or rustc.exe that initiate outbound network connections within sixty seconds of execution. A Deno or Python environment running on a non-developer endpoint indicates immediate compromise.
- Detect AMSI Tampering: Implement behavioral alerts for memory-patching techniques that target the Antimalware Scan Interface (AMSI). Catching defense evasion early prevents fileless execution in later stages.
- Analyze Outbound Network Metadata: Track anomalous outbound traffic patterns, such as unexpected UDP/53 requests, DNS queries containing .microsoft.com suffixes, and HTTPS connections to public Steam profiles.
Ultimately, chasing static indicators that change with every execution leaves security teams one step behind. Defending against these stealthy evasions requires moving from point-in-time checks to Continuous Compromise Assessment.
By analyzing network metadata in real time with Lumu Defender, security teams gain the visibility needed to detect covert C2 channels, measure unique compromise levels, and automatically trigger responses across their existing security stack before exfiltration occurs.
To find out more about Operation Device Manager, our complete in-depth technical report is available at: Operation Device Manager: Eight Stages of a Multi-Payload Malware Campaign