Phishing Receipts Deliver ScreenConnect for Persistent Remote Access

Summary

AhnLab describes phishing emails that use fake transaction receipts and a malicious PDF to install ScreenConnect, giving attackers persistent remote access to compromised systems.

Key points

The emails impersonate employees of a US company and urge recipients to open a supposed transaction receipt.
The attached PDF prompts users to download a fake Adobe Flash Player updater and links to an attacker-controlled site.
Running the downloaded VBS script displays a legitimate-looking receipt while silently downloading and installing an MSI.
The MSI installs ScreenConnect, which connects the compromised system to an attacker-controlled relay for persistent remote access.
Attackers could use that access for follow-up actions including file transfers, command execution, and deploying additional payloads.
The article provides related URLs and MD5 hashes as indicators of compromise.

Article Details

Attack Vectors: Phishing emails impersonated employees of a US company and used a purported transaction receipt to entice recipients to open an attached PDF.
The PDF prompted recipients to allow an external link, redirecting them to a site believed to be operated by a threat actor.
The site downloaded a VBScript file. When run, the script re-executed with administrator privileges, displayed a decoy receipt, and silently downloaded and installed an MSI package.
The MSI installed ScreenConnect, which the threat actor used to obtain persistent remote access and enable follow-up actions including file transfer, command execution, and additional payload deployment.
Defensive Notes: Treat unexpected transaction-receipt emails and attachments with caution, and do not allow external links in documents from untrusted sources.
Investigate unexpected VBScript execution and silent MSI installations, including ScreenConnect installations that create unfamiliar Access sessions.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`relay[.]gamedbd[.]com`	Threat actor server hostname used by ScreenConnect for remote access; the article specifies port 8041.
MD5	`6557ed877a26fa254bcebb59a474c47a`	MD5 indicator listed in the article's threat-analysis section.
MD5	`ab707764ad3fc2611ed1cf8e9ce85d9d`	MD5 indicator listed in the article's threat-analysis section.
URL	`hxxp[:]//payment-six-eta[.]vercel[.]app/doc/payment_receipt[.]Pdf`	URL serving the decoy transaction receipt from the threat-associated site.
URL	`hxxp[:]//payment-six-eta[.]vercel[.]app/doc/sc[.]Msi`	URL serving the malicious MSI package.
URL	`hxxp[:]//transaction-sucessful[.]vercel[.]app/`	Redirect destination from the phishing PDF, believed by the source to be operated by a threat actor.
URL	`hxxps[:]//payment-six-eta[.]vercel[.]app/doc/sc[.]msi`	Indicator URL for the malicious MSI package.