{
  "family": "gt32supportgeeks",
  "sample_count": 20,
  "category": "advanced_threat",
  "description": "Rogue:Win32/GT32SupportGeeks is a highly specific family of Scareware intimately tied to Tech Support Scams. It operates by locking the user's browser or displaying highly alarming, fake system errors, providing a toll-free number the user must call to 'resolve' the fake infection, leading directly to social engineering and financial extortion.<br><br><b>Understanding GT32SupportGeeks</b><br>To the victim, a GT32SupportGeeks infection is terrifying. A loud audio siren may play, and a full-screen window mimicking a Microsoft or Apple security alert appears, claiming the computer is blocked due to illegal activity or a severe virus. For a security analyst, this is a hybrid attack. The malware itself is relatively simple; its sole purpose is to facilitate the social engineering phase (`T1566`), where the victim calls a fraudulent call center and is coerced into paying hundreds of dollars for fake 'support' services.<br><br><b>Execution and the Scam Mechanism</b><br>GT32SupportGeeks is distributed via malvertising (malicious ads on legitimate sites) (`T1189`). When the ad executes, it uses JavaScript loops (`T1059.007`) in the browser to prevent the user from closing the tab or navigating away (Browser Locking). If dropped as an executable, it modifies the Registry (`T1112`) to launch full-screen on boot, disabling Task Manager and hiding the taskbar. When the victim calls the provided number, the scammers often request Remote Desktop access (via legitimate tools like TeamViewer or AnyDesk) (`T1219`). Once granted access, the scammers steal data, install actual malware, or simply run empty commands in a terminal to pretend they are 'fixing' the computer.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is extreme financial fraud and the compromise of the endpoint if the user granted remote access. Network logs will show traffic to domains known for hosting tech support scam infrastructure. EDR platforms will flag the unauthorized installation of remote access tools (RATs) if the victim permitted the scammer to connect.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566",
    "T1189",
    "T1059.007",
    "T1219",
    "T1491"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566",
      "name": "Phishing (Social Engineering)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "If the alert is contained within a web browser, use Task Manager (`Ctrl+Shift+Esc`) to forcefully terminate the browser process; do not attempt to click 'close' on the fake alert.",
    "If the user actually called the number and granted remote access, instantly disconnect the machine from the network.",
    "Assume total endpoint compromise if remote access was granted; perform a clean OS rebuild and enforce password resets for all accounts.",
    "Advise the user to immediately contact their bank and dispute any charges made to the fraudulent 'tech support' company."
  ],
  "what_to_avoid": [
    "Never call the toll-free number displayed on the screen; Microsoft, Apple, and legitimate AV vendors do not display phone numbers in security alerts.",
    "Avoid trying to interact with the fake lock screen, as it may trigger the downloading of secondary malware payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}