SOCRadar Details Rock’s The Quarry Phishing and Remote-Access Operation
Summary
SOCRadar profiles The Quarry, a Rock-operated MaaS/PhaaS ecosystem whose affiliates use tax-themed phishing, cloaking, VBS droppers and legitimate RMM tools. The report describes its campaign methods, victimology and ongoing activity.
Key points
- SOCRadar tracks Rock as the developer behind The Quarry, an affiliate-focused MaaS/PhaaS operation active since at least April 2025.
- Campaigns use tax-themed lures impersonating U.S. agencies and brands; SOCRadar reports that over 90% of recorded download events involved U.S. victims.
- The reported attack chain combines bulk email, Adspect cloaking, modular PHP phishing pages and delivery of legitimate RMM tools, primarily ScreenConnect.
- SOCRadar identified three VBS dropper variants, including one using PowerShell and AES decryption; the April 2026 variant reportedly added a UAC bypass.
- Reported post-exploitation tools can search for W-2 documents, collect browser history and credentials, and send victim information to Telegram.
- SOCRadar says affiliates operate separate infrastructure, complicating attribution; it reports new domains and Telegram activity continuing into April and May 2026.
Article Details
- Attack Vectors
- Affiliates send bulk tax-themed emails impersonating U.S. agencies and brands, using phishing links and VBS attachments.
- Phishing pages use Adspect cloaking to filter researchers, scanners, and sandboxes and show lures to intended victims.
- Victims are prompted to download and run a disguised remote access installer, or a VBS dropper that downloads and installs an RMM payload.
- Scrapers collect corporate domains and look for exposed credentials in publicly accessible resources, including JavaScript files.
- Post-exploitation scripts can search for W-2 documents and browser history and send collected information to Telegram.
- Defensive Notes
- Treat tax-themed prompts to install remote access software as suspicious; watch for unexpected ScreenConnect, Datto, or Tiflux agents on endpoints.
- Monitor for newly registered lookalike domains combining tax or government terms with action words, and pursue takedown where appropriate.
- Identify and close exposure of credentials and cloud access keys in publicly accessible resources.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationVBS variants use Base64 concatenation or hexadecimal encoding, and a PowerShell stage uses AES decryption.T1036.005 · Match Legitimate Resource Name or LocationRMM installers use tax-document-like filenames, including ScreenConnect.ClientSetup.exe and StatementID-5ecc7a9.exe.T1059.001 · PowerShellThe most advanced VBS variant runs a PowerShell loader that uses AES decryption before launching the payload.T1059.005 · Visual BasicVBS scripts are used as an alternative payload delivery path, with three reported variants.T1070.004 · File DeletionThe VBS delivery path deletes the MSI installer after installation.T1204 · User ExecutionVictims are prompted by the lure and a “Security Connector” message to run the RMM installer.T1548.002 · Bypass User Account ControlThe April 2026 VBS variant reportedly implemented a UAC bypass without a visible dialog.T1566.001 · Spearphishing AttachmentTax-themed emails can deliver the VBS dropper as an attachment.T1566.002 · Spearphishing LinkBulk emails direct victims through links to malicious domains and spoofed agency or brand portals.T1583.001 · DomainsThe operation registers custom tax-themed domains for phishing infrastructure.T1583.004 · ServerSelf-hosted ScreenConnect instances are provisioned as remote access infrastructure for affiliates.T1583.006 · Web ServicesPublic GitHub and GitLab repositories are used to host MSI payloads and decoy PDFs.T1587.001 · MalwareRock develops a modular PHP phishing kit, VBS droppers, PowerShell scripts, and bulk email tooling.T1596.005 · Scan DatabasesScrapers collect corporate domains by sector and search accessible resources, including JavaScript files, for hardcoded credentials.T1656 · ImpersonationPhishing pages impersonate the SSA, IRS, Adobe, Dropbox, DocuSign, and ConnectWise using customized branding.
Threat Actors
RockThe article identifies Rock as the developer and operator of The Quarry service, selling phishing and remote access tooling and infrastructure to affiliates. The article says campaigns are run by affiliates rather than directly by Rock.RockkyThe article identifies Rockky as an alias used by the developer identified as Rock, who sells and maintains the phishing and remote access toolkit.
Malware
Products
AdspectThe ecosystem uses legitimate RMM software, Adspect cloaking, and Telegram-based reporting to support campaigns impersonating the IRS, SSA, Adobe, Dropbox, DocuSign, and Messenger.DattoScreenConnect is the primary remote access payload, while Tiflux, Datto, and FleetDeck also appear in some campaigns.FleetDeckScreenConnect is the primary remote access payload, while Tiflux, Datto, and FleetDeck also appear in some campaigns.ScreenConnect#TheQuarryTelegramThe ecosystem uses legitimate RMM software, Adspect cloaking, and Telegram-based reporting to support campaigns impersonating the IRS, SSA, Adobe, Dropbox, DocuSign, and Messenger.TifluxScreenConnect is the primary remote access payload, while Tiflux, Datto, and FleetDeck also appear in some campaigns.
Tools
Rock VPS Mailerand both line up with the naming of the tools in the catalog, including Rocky Gmail Sender and Rock VPS Mailer.Rocky Email SorterA Rocky Email Sorter and additional scraping utilities support the pre-phishing stages.Rocky Gmail Senderused to stage payloads, and both line up with the naming of the tools in the catalog, including Rocky Gmail Sender and Rock VPS Mailer.
Countries
BrazilThe remaining share, around 5%, spans countries including Egypt, Brazil, Germany, Japan, and Canada, likely U.S.CanadaThe remaining share, around 5%, spans countries including Egypt, Brazil, Germany, Japan, and Canada, likely U.S.EgyptThe remaining share, around 5%, spans countries including Egypt, Brazil, Germany, Japan, and Canada, likely U.S.GermanyThe remaining share, around 5%, spans countries including Egypt, Brazil, Germany, Japan, and Canada, likely U.S.JapanThe remaining share, around 5%, spans countries including Egypt, Brazil, Germany, Japan, and Canada, likely U.S.United StatesRock, tracked by SOCRadar as The Quarry, is a one-person MaaS/PhaaS operation that sells a full phishing and remote access toolkit to affiliates running tax-themed campaigns against U.S.
Industries
E-commerce and RetailHealthcare and Medtech (15.8%), Media and Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education, Real Estate, Travel, and others.Educationand Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education, Real Estate, Travel, and others.Fintech and Financeare SaaS and Development (17.4%), Healthcare and Medtech (15.8%), Media and Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education, Real Estate, Travel, and others.Healthcare and MedtechBy sector, the most represented are SaaS and Development (17.4%), Healthcare and Medtech (15.8%), Media and Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education,Media and entertainmentBy sector, the most represented are SaaS and Development (17.4%), Healthcare and Medtech (15.8%), Media and Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education,real estate(14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education, Real Estate, Travel, and others.SaaS and DevelopmentBy sector, the most represented are SaaS and Development (17.4%), Healthcare and Medtech (15.8%), Media and Entertainment (14.7%), Fintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education,TravelFintech and Finance (11.1%), and E-commerce and Retail (8.6%), followed by Education, Real Estate, Travel, and others.