The instinct this week is to file ChainScript as a malware catalog update. Hash the binary, add a domain, close the ticket. That instinct is how a lot of cybersecurity programs keep losing the same fight. Blackpoint’s Adversary Pursuit Group documented a previously unseen remote access trojan that shows up as Spotify, Zoom Workplace, or Microsoft Teams, then pulls its next command post off Polygon. Your firewall is still waiting for a stable address. The operator already rotated.

ClickFix-style lures do the rest. The user pastes the “fix.” The RAT never has to win a brute-force contest against your edge. A second story from the same news cycle makes the same bet from the other direction: Jade Sleet walking into a smaller Indian IT provider with FLATROOF and ROOFDECK, because the shop that remotes into customers is a quieter door than your VPN login page.

ClickFix Turned the Helpdesk Into a Payload Path

You already trained people to follow on-screen instructions. ClickFix lives in that habit. A fake CAPTCHA, a “your meeting client needs a repair,” a prompt that says copy this command and hit Win+R. The lure does not look like malware. It looks like the same Zoom Workplace or Teams installer your company already blesses in email and in chat.

Blackpoint tracked the family under multiple build names: ComponentTask33, UpdateDigital, HostShared, OrchidViolet66. Those labels will change again. The constant is impersonation. If your threat-protection stack still keys on file names, product icons, and “known meeting software” publisher strings, you are classifying the costume.

Script-block logging and EDR telemetry already catch a chunk of this, when someone is looking. Most teams are looking for failed logons and known-bad hashes. Pasted PowerShell from a browser-spawned Run dialog sits in a different queue, if it sits in a queue at all. That is the operational gap. The user did what the page asked. Your SOC is still tuned for smash-and-grab authentication noise.

Treat every “run this repair command” pattern as an installation event. Same severity as an unexpected MSI. Same incident response clock. You would not let a stranger drop Teams Setup.exe on a finance laptop without a ticket. A copied command that pulls the same payload deserves the same reflex.

On-Chain Lookups Make Yesterday’s Blocklist a Prop

Static C2 is a gift to defenders. You sinkhole it, you firewall it, you watch the survivors. ChainScript’s reported trick is to stop giving you that gift. Polygon is public, cheap, and fast enough to publish a fresh callback locator when you burn the last one. The implant does not need your threat detection to miss a beacon forever. It needs you to keep blocking last week’s host.

This is a bad look for any program that still measures cyber security success in IP objects pushed to the edge. Defense in depth that ends at the perimeter assumes the next hop is an address you can enumerate. An on-chain pointer is an address you can enumerate too, if you instrument the lookup. Most shops never do. RPC endpoints for public chains blend into “the web.” They look like HTTPS. They are allowed because somebody in 2021 did not want to break a developer laptop.

You do not need a blockchain specialty team. You need to know which processes on a Zoom-looking binary are allowed to talk to unknown JSON-RPC hosts, and which ones should page you. If the only control you have is a network object group called “bad C2,” operators who can rewrite the pointer overnight will outlast your change window.

Jade Sleet’s IT-provider intrusion is the cousin of that failure, not a separate genre. SentinelOne tied the North Korean cluster to a much smaller India-based IT services firm, using FLATROOF and ROOFDECK, with Apple-related tooling in the mix. Developers and outsourced admins already hold keys you would never hand a random phishing victim. Compromising that shop buys remote access that your firewall already classifies as support.

Same class of miss: you modeled the attacker as someone hammering the front door. This week’s operators modeled you as someone who will execute a branded installer, or as someone who already opened a tunnel for a vendor. Brute-force still happens on the internet. It is not the interesting path here. The interesting path is trusted execution plus a C2 channel that refuses to sit still.

Cybersecurity Playbooks Still Start With an IP

If your runbook’s first containment step is “block the C2 host,” rewrite the first page. Containment for this pattern starts on the endpoint and on the identity that executed the command. Network objects are a follow-up, not the kill switch. Security hardening that still assumes a quiet, well-known callback will watch the wrong layer while the next locator publishes on-chain.

Do the unglamorous work in this order. None of it requires a new product line.

1. Turn pasted Run-dialog and unexpected powershell.exe / mshta.exe / cmd.exe launches from browsers into a high-severity detection. Alert on ClickFix fingerprints: “Press Win+R,” “fix this error” copy boxes, and repair instructions that origin from untrusted HTML.
2. Stop allowlisting meeting and media clients by display name. Require publisher authenticity, expected install path, and a hash that matches your software catalog. A Zoom-skinned RAT should fail that check even if the icon looks right.
3. Inventory which workstations may speak to public-chain RPC endpoints. Default deny for non-dev fleets. On dev fleets, alert when a process outside your approved wallets, nodes, or CI tools opens those destinations.
4. Re-scope every IT provider and MSP remote path this week. Standing VPN accounts, shared jump-box credentials, and always-on support agents are how a FLATROOF-style foothold becomes your incident. Move those sessions to just-in-time access, hardware-backed MFA, and a jump host you own and log.
5. Write an incident response branch for “user-executed installer” and a second branch for “trusted vendor admin.” Both assume the C2 indicator you have is already stale. Preserve memory, script logs, browser history, and outbound HTTPS even when the IP you blocked goes quiet.

Keep the hunt running after the first block

Immediate cuts buy you a night’s sleep. Ongoing defense in depth is what keeps ChainScript’s next build from walking the same road. Script-block logging and process ancestry should feed threat detection every day, not only during a named incident. Review software-catalog drift weekly: new “Teams” binaries, new “Spotify” helpers, new update tasks with names as sloppy as HostShared.

Vendor access needs the same cadence. If an India-based (or anywhere-based) IT shop can RDP your estate at 2 a.m. without a ticket, you have already published a second network. Log command activity on those sessions. Expire the grant. Watch for Apple and Windows admin tools appearing on support endpoints that should only run your approved remote suite.

Train the helpdesk to treat “the website told me to paste this” as a security event, not a how-to. The first person who hears a ClickFix story is usually not SOC. It is the person who resets passwords. Give them a one-line escalation: isolate the box, do not re-run the command “to see if it works,” keep the browser tab open for forensics.

You will still block IPs. Do it. Just stop pretending that threat-protection equals a current blocklist. Operators who can rotate C2 on a public chain, and operators who live in your IT vendor, are testing whether your cybersecurity program can follow a moving trust path. Most programs still follow addresses.

Frequently Asked Questions

Does a next-gen firewall make Polygon C2 irrelevant?

Only if you also inspect which processes are allowed to reach chain RPC hosts and you alert on new destinations. A firewall that only sinks last week’s callback IP will bless the lookup that fetches next week’s. Pair edge policy with process-level destination control on the endpoint.

How is ClickFix different from a normal phishing attachment?

The user executes living-off-the-land tooling with a command they pasted themselves, often after a page that looks like a CAPTCHA or client repair. Attachment-centric filters and “don’t click links” training miss it. Detect the Run dialog, the paste, and the child process tree.

Should every IT provider session now be treated as hostile?

Treat it as privileged access you do not currently monitor well. Jade Sleet’s reported use of a smaller IT services firm is a reminder that vendor admin endpoints inherit your blast radius. Just-in-time access, your jump host, and session logging are the controls; panic-firing the MSP is not a strategy.

Sources

• ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
• Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors