Date: 08/04/2026
Severity: High
Summary
DOUBLECUP is a new Russian Loader-as-a-Service (LaaS) for ClickFix campaigns operating since early June 2026. It demonstrates the growing sophistication of ClickFix campaigns by using steganography and environmental keying to deliver payloads while evading detection. The campaign deploys an updated CountLoader and the newly identified DeviceManager RAT, which leverage advanced techniques such as Windows binary patching and blockchain-based C2 resolution. As AI accelerates the development of custom malware, organizations must rely on behavioral analytics and telemetry-driven detection instead of static IOCs to identify emerging threats.
Indicators of Compromise (IOC) List
Domain/URLs | srv641398444.host.ultaserver.net nxtdrcliam.site canva-arts.com cap-t1.spec-connectweb3.tv cap-t2.spec-connectweb3.tv cap.spec-connectweb3.tv cloud-electronic.com cloudscraft.com doublecap.ltd doublecap.live examcanvas.com storagepioneer.com supercloudsaver.com ticgo-cloud.com roqqcloud.com login-netsuite.com login-odoo.com verification-salesforce.com login-salesforce.com login-hubspot.com pending-verification.com alphastore.vg appleid-customertelemetry.gl http://67.219.107.18/1hgflssvslvidfugvbldiuv https://appleid-customertelemetry.gl/setup.sh https://appleid-customertelemetry.gl/AppleIDVerificationService https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe |
IP Address | 213.139.77.109 80.96.109.229 167.148.201.131 89.124.117.12 103.22.137.227 67.219.107.181 146.70.124.154 91.92.240.100 |
Hash | 882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6
8585721cbc46780903bd727e37a9ed07a33463852046ff65bc718ded4c80dfb1
28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9d
6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba
ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50
bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40
afe273533d6f9d0b8852988f6a4b34571dd52af4c690e54723a86257aa8a015d
08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69
|
File Paths | %LOCALAPPDATA%DeviceManagerconfig.json %LOCALAPPDATA%DeviceManageragent.log %LOCALAPPDATA%DeviceManageragent_main.pyw %LOCALAPPDATA%DeviceManageragent %USERPROFILE%App_<GUID>.py %TEMP%_dm_task.py %TEMP%_dm_<random_chars>.ps1 %TEMP%_dm_<random_chars>.bat %TEMP%t.xml |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "examcanvas.com" or url like "examcanvas.com" or siteurl like "examcanvas.com" or domainname like "cap-t1.spec-connectweb3.tv" or url like "cap-t1.spec-connectweb3.tv" or siteurl like "cap-t1.spec-connectweb3.tv" or domainname like "http://67.219.107.18/1hgflssvslvidfugvbldiuv" or url like "http://67.219.107.18/1hgflssvslvidfugvbldiuv" or siteurl like "http://67.219.107.18/1hgflssvslvidfugvbldiuv" or domainname like "verification-salesforce.com" or url like "verification-salesforce.com" or siteurl like "verification-salesforce.com" or domainname like "srv641398444.host.ultaserver.net" or url like "srv641398444.host.ultaserver.net" or siteurl like "srv641398444.host.ultaserver.net" or domainname like "https://appleid-customertelemetry.gl/setup.sh" or url like "https://appleid-customertelemetry.gl/setup.sh" or siteurl like "https://appleid-customertelemetry.gl/setup.sh" or domainname like "roqqcloud.com" or url like "roqqcloud.com" or siteurl like "roqqcloud.com" or domainname like "login-netsuite.com" or url like "login-netsuite.com" or siteurl like "login-netsuite.com" or domainname like "https://appleid-customertelemetry.gl/AppleIDVerificationService" or url like "https://appleid-customertelemetry.gl/AppleIDVerificationService" or siteurl like "https://appleid-customertelemetry.gl/AppleIDVerificationService" or domainname like "login-odoo.com" or url like "login-odoo.com" or siteurl like "login-odoo.com" or domainname like "nxtdrcliam.site" or url like "nxtdrcliam.site" or siteurl like "nxtdrcliam.site" or domainname like "doublecap.ltd" or url like "doublecap.ltd" or siteurl like "doublecap.ltd" or domainname like "cloud-electronic.com" or url like "cloud-electronic.com" or siteurl like "cloud-electronic.com" or domainname like "doublecap.live" or url like "doublecap.live" or siteurl like "doublecap.live" or domainname like "cap.spec-connectweb3.tv" or url like "cap.spec-connectweb3.tv" or siteurl like "cap.spec-connectweb3.tv" or domainname like "pending-verification.com" or url like "pending-verification.com" or siteurl like "pending-verification.com" or domainname like "cloudscraft.com" or url like "cloudscraft.com" or siteurl like "cloudscraft.com" or domainname like "login-salesforce.com" or url like "login-salesforce.com" or siteurl like "login-salesforce.com" or domainname like "cap-t2.spec-connectweb3.tv" or url like "cap-t2.spec-connectweb3.tv" or siteurl like "cap-t2.spec-connectweb3.tv" or domainname like "alphastore.vg" or url like "alphastore.vg" or siteurl like "alphastore.vg" or domainname like "login-hubspot.com" or url like "login-hubspot.com" or siteurl like "login-hubspot.com" or domainname like "ticgo-cloud.com" or url like "ticgo-cloud.com" or siteurl like "ticgo-cloud.com" or domainname like "appleid-customertelemetry.gl" or url like "appleid-customertelemetry.gl" or siteurl like "appleid-customertelemetry.gl" or domainname like "storagepioneer.com" or url like "storagepioneer.com" or siteurl like "storagepioneer.com" or domainname like "canva-arts.com" or url like "canva-arts.com" or siteurl like "canva-arts.com" or domainname like "https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe" or url like "https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe" or siteurl like "https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe" or domainname like "supercloudsaver.com" or url like "supercloudsaver.com" or siteurl like "supercloudsaver.com" |
Detection Query 2 : | dstipaddress IN ("213.139.77.109","89.124.117.12","103.22.137.227","146.70.124.154","91.92.240.100","67.219.107.181","80.96.109.229","167.148.201.131") or srcipaddress IN ("213.139.77.109","89.124.117.12","103.22.137.227","146.70.124.154","91.92.240.100","67.219.107.181","80.96.109.229","167.148.201.131") |
Detection Query 3 : | sha256hash IN ("ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50","8585721cbc46780903bd727e37a9ed07a33463852046ff65bc718ded4c80dfb1","08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69","afe273533d6f9d0b8852988f6a4b34571dd52af4c690e54723a86257aa8a015d","6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba","882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6","28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9d","bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40")
|
Detection Query 4 : | datasourcename = "Windows Security" and eventtype = "4663" and objectname In ("%LOCALAPPDATA%\DeviceManager\config.json", "%LOCALAPPDATA%\DeviceManager\agent.log", "%LOCALAPPDATA%\DeviceManager\agent_main.pyw", "%LOCALAPPDATA%\DeviceManager\agent", "%USERPROFILE%\App_%.py", "%TEMP%\_dm_task.py", "%TEMP%\_dm_%.ps1", "%TEMP%\_dm_%.bat", "%TEMP%\t.xml") |
Detection Query 5 : | technologygroup = "EDR" and objectname In ("%LOCALAPPDATA%\DeviceManager\config.json", "%LOCALAPPDATA%\DeviceManager\agent.log", "%LOCALAPPDATA%\DeviceManager\agent_main.pyw", "%LOCALAPPDATA%\DeviceManager\agent", "%USERPROFILE%\App_%.py", "%TEMP%\_dm_task.py", "%TEMP%\_dm_%.ps1", "%TEMP%\_dm_%.bat", "%TEMP%\t.xml") |
Reference:
https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/