GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

## Executive Summary Recorded Future details GrayAlpha (linked to FIN7) campaigns that use fake browser-update pages, fake 7-Zip download sites, and the TAG-124 traffic distribution system to deliver two custom PowerShell loaders (PowerNet and MaskBat) which ultimately deploy NetSupport RAT; the report includes infrastructure attribution, extensive IoCs (domains, IPs, MSIX certificate serials and hashes), and recommended mitigations such as application allow-listing and detection rules.