Security researchers at SANS ISC have identified a new campaign where a lightweight, unidentified RAT is serving as the primary delivery mechanism for the more feature-rich NetSupport RAT. This multi-stage infection chain is designed to bypass traditional signature-based detection by using a highly obfuscated first-stage dropper. NetSupport RAT, originally a legitimate remote administration tool, has been co-opted by various threat actors for years due to its robust feature set and 'living-off-the-land' (LotL) characteristics. The current campaign is notable for its use of sophisticated anti-analysis techniques in the initial stage, including environment checking and delayed execution. Once the unidentified RAT confirms it is not running in a sandbox, it fetches the NetSupport payload from a remote C2 server. This tactic highlights the ongoing evolution of initial access brokers (IABs) who are constantly refining their delivery methods to maintain persistence in target networks. Organizations should focus on behavioral detection of remote management tools and implement strict application whitelisting to prevent the execution of unauthorized administrative software. The use of NetSupport RAT in this context suggests that the actors are prioritizing stability and ease of use for post-exploitation activities, such as data exfiltration or the deployment of additional malware like ransomware. The correlation between these 'unidentified' initial stages and known payloads indicates a maturing ecosystem where specialized developers create the 'keys' (droppers) for established 'tools' (RATs). This modular approach to malware development makes attribution more difficult and increases the overall efficiency of cyber-espionage and financial crime operations. Defensive teams must look beyond the final payload and analyze the unique characteristics of the initial stage to identify broader campaign patterns.