Attackers Abuse MDM Platforms to Deploy Remote-Access Tools
Summary
Huntress describes two incidents in which phishing or a deceptive link led to unauthorized Hexnode or Rippling MDM enrollment, letting attackers install ScreenConnect and restore remote access after removal.
Key points
- Huntress reports attackers misused legitimate Hexnode and Rippling MDM platforms; the incidents did not involve exploiting vulnerabilities in those products.
- In the Hexnode case, proposal-themed phishing delivered an MSI disguised as a DocuSign installer that installed Hexnode components.
- The attacker used Hexnode to install ScreenConnect; after an MSP removed it, the tool reappeared hours later and connected to the same relay, prompting endpoint isolation and remediation.
- In the Rippling case, a link impersonating a Microsoft Teams invitation led to MDM enrollment; the agent was installed with SYSTEM-level permissions, and ScreenConnect followed about 35 minutes later.
- Huntress traced the Rippling activity to the online management agent, suggesting the attacker had created an account to conduct the attack.
- Huntress recommends correlating unexpected MDM enrollments, management agents, RMM installations, and unfamiliar outbound relay connections across identity, endpoint, and network telemetry.
- Recommended response includes isolating the endpoint, removing it from the unauthorized MDM tenant, disabling attacker-created accounts, revoking sessions or tokens, resetting affected credentials, and reimaging if integrity is uncertain.
Article Details
- Attack Vectors
- Phishing emails used business-themed proposal, document-signing, tax-planning, and meeting lures to get recipients to click links.
- A fake DocuSign-named MSI installed legitimate Hexnode MDM components; in another incident, a lookalike Teams page redirected to a PHP file that facilitated enrollment in an attacker-controlled Rippling MDM tenant.
- After MDM enrollment, the attackers used the privileged management path to install or reinstall ScreenConnect and connect to external relays.
- Defensive Notes
- Inventory authorized MDM products, tenants, agents, and RMM instances; treat unexpected enrollments, management agents, or RMM installations as security events.
- Train users to verify unexpected meeting, document-signing, and proposal-review requests, and scrutinize business-themed lures with email and web controls.
- Correlate identity, MDM, endpoint, and network telemetry, including enrollment activity, RMM installations, and outbound connections to unfamiliar relays.
- For suspected compromise, isolate the endpoint, remove it from the unauthorized MDM tenant, disable attacker-created accounts, revoke active sessions or tokens, reset affected credentials, and reimage the endpoint if its integrity cannot be confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//teams-microsoftcom5d41402abc4b2a76b9719d911017c592[.]kiratham[.]com/teams/?c4ca4238a0b923820dcc509a6f75849b | Lookalike Teams URL used to present a page titled “Calendar” in the Rippling incident. |
| URL | hxxps[:]//teams-microsoftcom5d41402abc4b2a76b9719d911017c592[.]kiratham[.]com/teams/14/enroll14.php | Lookalike Teams URL used to facilitate enrollment in the attacker-controlled Rippling MDM tenant. |
| URL | hxxps[:]//webdocusign[.]viewportal[.]es/Windows/download/index.php | Delivery URL for the fake DocuSign/proposal installer that installed Hexnode components. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe Hexnode installation package was named eD0cuSign_Installer.msi to mimic a DocuSign installer.T1098.005 · Device RegistrationThe attackers enrolled endpoints in MDM, including enrollment into an attacker-controlled Rippling tenant, establishing a privileged management path described as persistence.T1105 · Ingress Tool TransferThe fake MSI was downloaded from a phishing link, and ScreenConnect installers were staged through MDM.T1204.001 · Malicious LinkRecipients clicked email links that downloaded the fake installer or opened the lookalike Teams page.T1219 · Remote Access ToolsThe attackers installed or reinstalled ScreenConnect as unauthorized remote access software and connected it to their relays.T1566.002 · Spearphishing LinkThe incidents began with phishing emails containing links to fake installer or lookalike meeting pages.
People
Vendors
HexnodeHuntress is seeing attackers abusing legitimate MDM platforms – like Hexnode and Rippling – by using social engineering to enroll devices or install management agents.RipplingHuntress is seeing attackers abusing legitimate MDM platforms – like Hexnode and Rippling – by using social engineering to enroll devices or install management agents.
Products
HexnodeHuntress is seeing attackers abusing legitimate MDM platforms – like Hexnode and Rippling – by using social engineering to enroll devices or install management agents.Microsoft Teams"Re: Tax Planning and Preparation Inquiry." The email included a link to what appeared to be a Microsoft Teams meeting invitation. RipplingHuntress is seeing attackers abusing legitimate MDM platforms – like Hexnode and Rippling – by using social engineering to enroll devices or install management agents.