Attackers Use Fake Social Security Emails to Install ScreenConnect for Remote Access
Summary
Forcepoint X-Labs reports a phishing campaign impersonating the US Social Security Administration that uses a malicious .cmd script to weaken Windows protections, hide payloads and install ScreenConnect for persistent remote access.
Key points
- Forcepoint X-Labs reports emails impersonating the US Social Security Administration, including a fake SSA[.]COM domain and the misspelling “eStatemet.”
- The malicious .cmd script uses PowerShell auto-elevation to seek administrator privileges, then changes the registry to disable Windows SmartScreen and removes the Mark-of-the-Web.
- The script uses Alternate Data Streams to hide files and enables a silent MSI installation.
- The campaign installs ConnectWise ScreenConnect v25.2.4.9229 as a persistent remote-access tool; the article says the version uses a revoked certificate.
- According to the researchers, a System.config file hardcodes a callback to dof-connecttop over port 8041, associated with the Aria Shatel Company Ltd network in Iran.
- The reported targets include organizations in the UK, US, Canada and Northern Ireland, particularly in government, healthcare and logistics.
Article Details
- Attack Vectors
- Phishing emails impersonate the US Social Security Administration and use a fake domain and spelling errors to persuade recipients to run an attached .cmd script.
- The script uses PowerShell auto-elevation to obtain administrator privileges, disables Windows SmartScreen, removes the Mark-of-the-Web, and hides payloads using Alternate Data Streams.
- The script silently installs ConnectWise ScreenConnect v25.2.4.9229, configured to call back to a specified server over port 8041, for remote access.
- Defensive Notes
- Treat unexpected government attachments as potential threats.
- The report identifies disabled Windows SmartScreen and removed Mark-of-the-Web as part of the attack, so investigate systems where these protections have been changed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ssa[.]com | Fake domain used in phishing emails impersonating the US Social Security Administration. |
MITRE ATT&CK
T1059.001 · PowerShellThe script uses PowerShell auto-elevation to obtain administrator privileges.T1112 · Modify RegistryThe script modifies the registry to disable Windows SmartScreen.T1204.002 · Malicious FileThe attack relies on a recipient opening and running the attached .cmd script.T1219 · Remote Access ToolsThe attackers silently install ConnectWise ScreenConnect and use it for remote access.T1548.002 · Bypass User Account ControlThe report describes PowerShell auto-elevation to obtain administrator privileges.T1553.005 · Mark-of-the-Web BypassThe script removes the Mark-of-the-Web from files.T1562.001 · Disable or Modify ToolsThe script disables Windows SmartScreen to weaken system defenses.T1564.004 · NTFS File AttributesThe script uses Alternate Data Streams to hide payloads.T1566.001 · Spearphishing AttachmentAttackers sent phishing emails with a malicious .cmd script attachment.
Vendors
Products
ConnectWise ScreenConnectThe script disables Windows defenses, hides payloads using Alternate Data Streams, and silently installs ConnectWise ScreenConnect as a persistent RAT to access high-value sectors;Microsoft Defender SmartScreenThe script disables Windows SmartScreen, removes the Mark-of-the-Web, and uses Alternate Data Streams to hide files.
Countries
CanadaResearchers at Forcepoint X-labs found a campaign targeting organisations in the UK, US, Canada, and Northern Ireland where attackers impersonate the US Social Security Administration to trick users into running aIranIt silently installs ConnectWise ScreenConnect v25.2.4.9229 with a revoked certificate and a hardcoded callback to dof-connecttop on the Aria Shatel Company Ltd network (Iran) via port 8041.Northern IrelandResearchers at Forcepoint X-labs found a campaign targeting organisations in the UK, US, Canada, and Northern Ireland where attackers impersonate the US Social Security Administration to trick users into running aUnited KingdomResearchers at Forcepoint X-labs found a campaign targeting organisations in the UK, US, Canada, and Northern Ireland where attackers impersonate the US Social Security Administration to trick users into running a
Industries
GovernmentAttackers focus on government, healthcare, and logistics data; treat unexpected government attachments as potential threats.HealthcareAttackers focus on government, healthcare, and logistics data; treat unexpected government attachments as potential threats.logisticsAttackers focus on government, healthcare, and logistics data; treat unexpected government attachments as potential threats.