> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IOC Alert: NetSupport Manager RAT Payload Delivery – wood-simple[.]com/drip.sym
- URL: https://darkwebinformer.com/ioc-alert-netsupport-manager-rat-payload-delivery-wood-simple-com-drip-sym/
- Published: 2025-09-02T15:30:47.000Z
- Updated: 2025-09-04T22:19:38.000Z
- Author: Dark Web Informer
- Tags: IOC

📖 **Overview**  
A new URL-based indicator has been identified delivering **NetSupport Manager RAT**. The domain is associated with the SmartApeSG campaign and is actively used for payload delivery. This IOC represents a high-confidence threat to endpoints, enabling full remote access capabilities once executed.

---

📌 **Key Details**

| Field           | Information                  |
| --------------- | ---------------------------- |
| **Type**        | URL                          |
| **Indicator**   | wood-simple\[.\]com/drip.sym |
| **Threat Type** | Payload Delivery             |
| **Malware**     | win.netsupportmanager\_rat   |
| **Confidence**  | 100%                         |
| **Date**        | 02 Sep 2025 – 12:10:58 UTC   |
| **Tags**        | SmartApeSG                   |
| **Reporter**    | monitorsg                    |

---

🔎 **URLScan Result**  
Page Title: No Title  
Screenshot: <https://urlscan.io/screenshots/01990a58-927f-71f8-8d21-5b4f87b96914.png>  
Result: [https://urlscan.io/result/01990a58-927f-71f8-8d21-5b4f87b96914/](https://urlscan.io/result/01990a58-927f-71f8-8d21-5b4f87b96914)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2025/09/978235982357896918797865213-2.jpg)

---

📡 **Related Intelligence**  
VirusTotal Report: <https://www.virustotal.com/gui/url/93b064ddedb6cf394cce4eadc05caad150e6834f79ff93a796e71ba4a3c03ec7>  
Reference: [https://infosec.exchange/@monitorsg/115134631148960678](https://infosec.exchange/@monitorsg/115134631148960678?utm%5Fsource=chatgpt.com)

---

🛡️ **Defensive Guidance**

- Block `wood-simple[.]com` at the network and endpoint level.
- Monitor for file retrieval attempts from `/drip.sym`.
- Hunt for NetSupport Manager RAT persistence artifacts in endpoint telemetry.
- Review proxy and firewall logs for suspicious outbound requests to this domain.