Actor Profile

DOUBLECUP is a Russian loader-as-a-service platform that has operated since early June 2026. The service provides customers with licenses and a Go-based Windows tool for creating malicious ClickFix campaigns. DOUBLECUP handles core infrastructure including hosting steganographic PNG images, managing session and signal endpoints, providing encryption keys, and automatically rebuilding payloads. Customers are responsible for creating and hosting the ClickFix websites, adding generated frontend code, and implementing additional obfuscation measures. The service was discovered by SOCRadar through an open directory at 213[.]139.77[.]109:9090 containing test files, with the same IP hosting the licensing panel.

TTPs (Tactics, Techniques, Procedures)

DOUBLECUP employs ClickFix social engineering attacks (T1204.001) using fake CAPTCHA prompts on login pages impersonating legitimate services (NetSuite, Odoo, HubSpot, Salesforce). The attack chain uses steganography (T1027.003) to hide malicious code in PNG images cached by victims' browsers. Commands are automatically copied to clipboard and executed via command-line interfaces (T1059.003 for Windows Command Shell, T1059.001 for PowerShell). The service uses findstr and certutil to extract hidden payloads from browser cache. CountLoader establishes persistence through scheduled tasks on Windows (T1053.005) and LaunchAgents on macOS (T1543.001). DeviceManager RAT uses EtherHiding technique, retrieving C2 addresses from Ethereum/Polygon smart contracts (T1102), and exfiltrates data via DNS A and TXT records (T1048.003). The malware performs system information discovery (T1082), checks for cryptocurrency wallets and browser extensions, and can download and execute additional payloads (T1105).

Targets & Patterns

DOUBLECUP campaigns primarily target the technology sector, with observed attacks impersonating major SaaS platforms including NetSuite, Odoo, HubSpot, and Salesforce. The targeting strategy focuses on users of enterprise business applications, likely to compromise corporate credentials and gain initial access to organizational networks. The service delivers cross-platform malware, with CountLoader targeting both Windows and macOS (Intel and Apple Silicon), indicating broad targeting across enterprise environments. DeviceManager RAT includes CIS country checks, avoiding execution in Commonwealth of Independent States nations, suggesting targeting of Western organizations. The use of fake login pages for popular business platforms indicates focus on credential theft and corporate espionage, with secondary objectives including cryptocurrency theft through wallet detection capabilities.

Historical Context

DOUBLECUP represents an evolution in ClickFix attack methodology, building on techniques previously documented by Huntress in campaigns that concealed LummaC2 and Rhadamanthys payloads within PNG pixel data. The service's emergence in June 2026 coincides with a broader trend of ClickFix attacks, including Steam forum campaigns delivering XMRig cryptominers and other social engineering-based malware distribution. The use of EtherHiding by DeviceManager RAT continues a pattern of threat actors leveraging blockchain infrastructure for C2 resilience, making takedown efforts more difficult. The loader-as-a-service model follows the established cybercrime-as-a-service ecosystem, lowering technical barriers for operators while centralizing infrastructure management.

Defensive Recommendations

  • Monitor browser cache directories for suspicious PNG files and detect T1027.003 steganography by scanning for anomalous file sizes and entropy patterns in cached images
  • Block execution of clipboard-based commands via T1059.003 and T1059.001 by implementing application whitelisting and detecting suspicious certutil.exe and findstr.exe usage through EDR telemetry
  • Detect T1053.005 scheduled task creation and T1543.001 LaunchAgent persistence by monitoring for CountLoader indicators including unexpected task creation and file writes to ~/Library/LaunchAgents/
  • Implement DNS monitoring to identify T1048.003 exfiltration via DNS A and TXT record queries, particularly high-volume or anomalous DNS traffic patterns associated with DeviceManager RAT
  • Block access to known DOUBLECUP infrastructure including 213[.]139.77[.]109 and monitor for T1102 Web Service abuse by detecting Ethereum/Polygon smart contract queries used for EtherHiding C2 resolution

---

# Geopolitical Context

Geopolitical Context

DOUBLECUP represents the continued evolution of Russia-based cybercrime-as-a-service infrastructure, operating since June 2026 as a commercial loader platform that commoditizes sophisticated attack techniques. The service's use of steganography to conceal malware in browser-cached PNG images, combined with ClickFix social engineering tactics, reflects the ongoing professionalization of the Russian-language cybercrime ecosystem. By offering turnkey infrastructure—including payload hosting, encryption key management, and automatic rebuilds—DOUBLECUP lowers technical barriers for affiliates targeting enterprise cloud platforms such as NetSuite, Odoo, HubSpot, and Salesforce. The deployment of CountLoader (with cross-platform Windows and macOS variants) and the DeviceManager RAT (which uses blockchain-based C2 resolution via Ethereum and Polygon smart contracts) demonstrates the integration of emerging technologies into criminal toolkits. DeviceManager's hardcoded exclusion of Commonwealth of Independent States (CIS) countries is consistent with the operational security practices of Russia-based threat actors, who typically avoid targeting domestic or allied jurisdictions to reduce law enforcement scrutiny.

State Actor Alignment

DOUBLECUP appears to be a commercially operated service within the Russian-language cybercrime ecosystem rather than a state-sponsored platform. However, its operational characteristics—including CIS country exclusions in the DeviceManager RAT and the use of Russian infrastructure (IP 213.139.77.109)—are consistent with threat actors operating within or from Russian jurisdiction. This geographic and linguistic nexus raises questions about the permissive environment for cybercrime infrastructure in Russia, particularly as Western sanctions and law enforcement actions have historically struggled to disrupt services hosted in non-cooperative jurisdictions. While there is no evidence linking DOUBLECUP to state intelligence services, the technology sector targeting and credential harvesting capabilities could provide dual-use value if criminal affiliates compromise organizations of strategic interest. The service's availability to multiple customers increases the difficulty of attribution for downstream intrusions, complicating efforts to distinguish financially motivated crime from espionage or pre-positioning activity.

Business Impacty pro region

DOUBLECUP's targeting of widely used enterprise SaaS platforms—NetSuite, Odoo, HubSpot, and Salesforce—poses risks to organizations across North America, Europe, and other regions reliant on cloud-based business applications. The cross-platform nature of CountLoader, with dedicated macOS variants for Intel and Apple Silicon architectures, suggests an intent to compromise corporate environments that have diversified beyond Windows endpoints. European organizations, particularly those in the technology sector and those subject to NIS2 Directive requirements, face heightened supply chain and third-party risk if DOUBLECUP affiliates successfully compromise SaaS credentials or deploy persistent access tools. The use of blockchain-based C2 infrastructure (Ethereum and Polygon smart contracts) complicates takedown efforts and may require coordination between law enforcement, blockchain analytics firms, and decentralized network participants—a challenge for jurisdictions with limited experience in crypto-enabled threat disruption. The service's modular, license-based model also increases the likelihood of geographically dispersed affiliate activity, making regional threat intelligence sharing and cross-border cooperation essential for effective defense.

Forecast

If DOUBLECUP continues to operate without disruption, it is likely to attract additional affiliates seeking low-friction access to steganographic delivery and cross-platform payload capabilities, potentially increasing the volume of ClickFix-style attacks targeting enterprise cloud platforms. Should law enforcement or private sector entities identify and disrupt the service's infrastructure (particularly the licensing panel at 213.139.77.109), affiliates may migrate to alternative loaders or attempt to replicate DOUBLECUP's steganography and blockchain C2 techniques in bespoke tooling. If DeviceManager RAT infections proliferate, organizations in non-CIS countries may experience an uptick in credential theft, reconnaissance activity, and secondary payload delivery, particularly if affiliates sell or broker access to initial compromise footholds. The integration of blockchain-based C2 resolution may prompt other malware developers to adopt similar techniques, complicating network-based detection and requiring defenders to enhance visibility into DNS exfiltration channels and smart contract interactions. Increased awareness of browser cache-based steganography may drive adoption of endpoint detection rules targeting certutil and findstr abuse, though determined attackers are likely to iterate on obfuscation and execution methods.