CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

CNCMachineRMS

malware · malware:cncmachinerms single-source

Previously undocumented x64 remote-access trojan delivered via a four-stage BabaDeda loader chain that abuses a signed IBM SPSS IDE binary's scripting engine and smuggles shellcode via the EnumTimeFormatsEx API; hash-resolved APIs, stack-built strings, custom C2 protocol, seven persistence mechanisms (LevelBlue SpiderLabs, 2026-08-10).

Coverage
1
first 2026-08-28 → last 2026-08-30
Latest activity
2026-08-28
A ClickFix lure abuses a signed IBM SPSS binary's own scripting engine, then hides its final shellcode…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
1
1 hosts

Defender insights

What each entry about CNCMachineRMS tells a defender to do, newest first.

2026-08-28NOTABLEA ClickFix lure abuses a signed IBM SPSS binary's own scripting engine, then hides its final shellcode injection inside a Windows time-formatting call

Triage

Story timeline

  1. 2026-08-28CNCMachineRMS, an undocumented remote-access trojan delivered through a four-stage BabaDeda loader chain that smuggles shellcode via a benign Windows date-formatting API
    active-threatsA ClickFix lure abuses a signed IBM SPSS binary's own scripting engine, then hides its final shellcode injection inside a Windows time-formatting call

Hunting pivots

Affected products
IBM SPSS StatisticsMicrosoft Windows
Tags
infostealer
ATT&CK techniques (5 across 4 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • ExecutionUser Execution: Malicious File · Hijack Execution Flow: DLL
  • PersistenceBoot or Logon Autostart Execution
  • Privilege EscalationProcess Injection · Boot or Logon Autostart Execution
  • StealthObfuscated Files or Information · Process Injection · Hijack Execution Flow: DLL

Execution TA0002

T1204.002User Execution: Malicious File×1

An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Persistence TA0003

T1547Boot or Logon Autostart Execution×1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Privilege Escalation TA0004

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

T1547Boot or Logon Autostart Execution×1

Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon. These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Stealth TA0005

T1027Obfuscated Files or Information×1

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

T1055Process Injection×1

Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-28/cncmachinerms-babadeda-loader-enumtimeformats-shellcode · ATT&CK page ↗

Entries about CNCMachineRMS (1)

2026-08-28 · view entry permalink →

NOTABLEupdatedNATOB2

CNCMachineRMS, an undocumented remote-access trojan delivered through a four-stage BabaDeda loader chain that smuggles shellcode via a benign Windows date-formatting API

LevelBlue SpiderLabs documents CNCMachineRMS, a previously undocumented 1.14 MB x64 remote-access trojan delivered through a four-stage BabaDeda loader chain. A ClickFix-style lure launches a legitimately signed IBM SPSS IDE executable (WinWrapIDE.exe), abusing its scripting engine to load a malicious DLL: "infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL" (LevelBlue SpiderLabs, 2026-08-10). Four decoy DLLs then load in sequence through standard Windows DLL import resolution before the final stage smuggles its shellcode into execution via EnumTimeFormatsEx, a benign date-formatting Windows API: "the final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API" (LevelBlue SpiderLabs, 2026-08-10), a technique that hides the injection point from analysts looking for conventional process-injection APIs.

The final implant has no import table and resolves its APIs by hash at runtime, builds its strings on the stack rather than storing them statically, uses a custom C2 protocol, takes a screenshot on first contact, beacons roughly every 600 seconds, and installs seven distinct persistence mechanisms: "it takes a screenshot on first contact, then beacons every 600 seconds", while the decoded strings describe "a local account backdoor, seven persistence mechanisms, and twenty typed commands for staging and running whatever the operator sends next" (LevelBlue SpiderLabs, 2026-08-10). Capabilities include interactive shell access, file management, screen capture and local account backdoors. BabaDeda-chain ClickFix lures are a recurring initial-access vector across the covered sectors, making the delivery mechanism as relevant as the payload itself.

Triage: the API-hashing and stack-built-strings design defeats static string-based detection, so behavioural signals carry the weight here, a legitimately signed application (IBM SPSS or any similarly abused signed binary) spawning a scripting-engine child process that loads an unsigned DLL is the first anomaly, and a process invoking EnumTimeFormatsEx immediately followed by execution flow transferring into memory it just wrote (rather than into a legitimate formatting routine) is the discriminator against the API's ordinary, benign use, no legitimate application calls this function as a prelude to code execution elsewhere in its own address space.

Infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL.

The final stage smuggles shellcode into execution via EnumTimeFormatsEx, a benign date-formatting API.

It takes a screenshot on first contact, then beacons every 600 seconds.

LevelBlue SpiderLabs 2026-08-10
Correctionrun 2026-08-30T1312Z-auditevidencesourcing_notebody

Two quotations here were not verbatim. The delivery quote is: "Infection starts with a ClickFix lure that launches a legitimately signed IBM SPSS IDE executable, WinWrapIDE.exe, whose scripting engine is abused to load a malicious DLL" (LevelBlue SpiderLabs, 2026-08-10); the executable is named in the source and was dropped here. The second was a composite that does not exist as a sentence anywhere in the article: LevelBlue writes "It takes a screenshot on first contact, then beacons every 600 seconds" as its own bullet, and separately that the decoded strings describe "a local account backdoor, seven persistence mechanisms, and twenty typed commands for staging and running whatever the operator sends next" (same article). Every behaviour this entry describes is still what LevelBlue reports; what was wrong was presenting two passages as one quotation.

threat28 Aug 06:30Zsingle-sourceOpen finding →
Sources: LevelBlue SpiderLabs

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • levelblue.com1 (100%)
All cited sources (1)