Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Hackers Use Potemkin Loader to Deliver RMMProject RAT in ClickFix Intrusion
Malware Families
Excerpt
A new wave of ClickFix infections has been discovered, exploiting social engineering to deliver a custom malware loader known as Potemkin. In a recent intrusion in May 2026 spanning 11 network hosts, threat actors bypassed modern security controls to deploy the RMMProject remote access trojan (RAT) and a blockchain-enabled backdoor called EtherRAT. The attack begins on unmonitored endpoints when victims are tricked into copying and executing a malicious command in the Windows…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Attack Flow10 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 1df4d1a69c1442a88c71dd106be894e0 | Medium | Score 53/100 | First seen |
| MD5 | 3eb6f92aedf74f109c7b4b0897ec39a8 | High | Score 81/100 | First seen |
| MD5 | e4d32349946c467ca2693c3da20f3701 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…