Phishing Campaigns Use Six RMM Tools to Gain Remote Access
Summary
AhnLab details phishing campaigns distributing ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able installers to enable threat actors to remotely control targeted systems.
Key points
- Phishing emails and pages disguise links or downloads as documents, software updates, or document viewers.
- ScreenConnect remains widely distributed, including through LNK, BAT, and VBS files.
- FleetDeck installers include a deployment ID used to connect the installed agent to the threat actor.
- Datto and SimpleHelp packages contain configuration data that can identify the operator or command-and-control server.
- Batch files in the JumpCloud and N-able examples download and install the RMM agents.
- AhnLab recommends verifying senders and URLs, treating unexpected attachments cautiously, and keeping operating systems and security software updated.
Article Details
- Attack Vectors
- Phishing emails and pages distribute RMM installers through attachments, links, or downloads disguised as documents or software updates.
- Users are prompted to click links in PDF documents or phishing pages, which download installers or batch files that install RMM software.
- Batch files can download and execute JumpCloud or N-able installers; the JumpCloud installer is supplied with a threat actor key.
- Defensive Notes
- Verify that email senders are trustworthy and carefully inspect linked URLs before clicking, including suspicious intermediate redirects.
- Check attachments for suspicious file extensions such as .Exe and .Com.
- Keep the operating system and security software updated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | alertxen[.]store | Domain listed as an indicator for the reported threat activity. |
| DOMAIN | bigsundoc[.]online | Domain listed as an indicator for the reported RMM distribution activity. |
| DOMAIN | ddncsoso[.]com | Domain listed as an indicator for the reported threat activity. |
| DOMAIN | hessattorneys[.]co[.]za | Domain used for a page disguised as DocuSign in the reported phishing activity. |
| DOMAIN | relay[.]lukiku[.]lol | Domain listed as an indicator for the reported threat activity. |
mark@hessattorneys[.]co[.]za | Email address embedded in the N-able installer configuration and attributed by the article to the threat actor. | |
| IPV4 | 86[.]106[.]143[.]132 | IP address listed as an indicator for the reported threat activity. |
| MD5 | 1017a75cf19be75f6ba21148a9b646d1 | MD5 hash listed in the article's indicators for the reported threat activity. |
| MD5 | 1562d523c2ebdc19c0ff8f3ea5f3763b | MD5 hash listed in the article's indicators for the reported threat activity. |
| MD5 | 594a652263e5e4eb96b5164d337bc1ca | MD5 hash listed in the article's indicators for the reported threat activity. |
| MD5 | 5a49d0b22ced22f9cf8b2015a327f163 | MD5 hash listed in the article's indicators for the reported threat activity. |
| MD5 | 5ac7526b582d9cf4f7854c52ee75f359 | MD5 hash listed in the article's indicators for the reported threat activity. |
| URL | hxxp[:]//216[.]250[.]252[.]58:8040/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest | ScreenConnect installer URL listed as an indicator for the reported distribution activity. |
| URL | hxxps[:]//178-83-121-6[.]cprapid[.]com/ReceiptDoc[.]vbs | VBS file URL listed as an indicator for the reported phishing distribution activity. |
| URL | hxxps[:]//admin[.]lukiku[.]lol/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=Guest | ScreenConnect installer URL listed as an indicator for the reported distribution activity. |
| URL | hxxps[:]//adobpro3d[.]s[.]gy/X334zpo8tl | URL listed as an indicator for the reported phishing distribution activity. |
| URL | hxxps[:]//bigsundoc[.]online/fold/package/ | Package URL listed as an indicator for the reported RMM distribution activity. |
MITRE ATT&CK
T1105 · Ingress Tool TransferPhishing links and batch files download RMM installers or other files onto victim systems.T1204.001 · Malicious LinkUsers are tricked into clicking phishing links or download buttons to obtain the installers.T1219 · Remote Access ToolsThreat actors exploit ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able for remote access and control.T1566.001 · Spearphishing AttachmentThe article describes RMM tools distributed through phishing emails using attachments.T1566.002 · Spearphishing LinkPhishing pages and links in PDF documents trick users into downloading RMM installers.
Threat Actors
Malware
ALPHVSimpleHelp has been used in attacks linked to the Play [5] ransomware, as well as in Medusa [6] and ALPHV (BlackCat) [7] ransomware attacks.BlackCathas been used in attacks linked to the Play [5] ransomware, as well as in Medusa [6] and ALPHV (BlackCat) [7] ransomware attacks.DragonForceRecently, instances of FleetDeck distribution have also been identified; FleetDeck was previously used by the “Scattered Spider” threat actors who distributed the DragonForce ransomware.Medusato be identified; SimpleHelp has been used in attacks linked to the Play [5] ransomware, as well as in Medusa [6] and ALPHV (BlackCat) [7] ransomware attacks.Playcontrol over infected systems continue to be identified; SimpleHelp has been used in attacks linked to the Play [5] ransomware, as well as in Medusa [6] and ALPHV (BlackCat) [7] ransomware attacks.
Products
Adobe Acrobat ProLike FleetDeck, it was distributed through a PDF document, which displays a Figure prompting the user to update Adobe Acrobat Pro to view the document.Datto RMMDatto RMM is also a cloud-based RMM solution that allows MSPs or IT administrators to install an agent on remote systems to perform endpoint monitoring, remote control, patch management, and executing a script.DocuSignThe following example is a Batch malware sample that disguises itself as DocuSign Viewer; to deceive users, it displays a Support page in the web browser alongside the N-able installation when executed.FleetDeckRMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)JumpCloudRMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)N-AbleRMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)NinjaOne[1] [2] In these attack cases, tools such as Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps were exploited.ScreenConnectRMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)SimpleHelpRMM tools currently being distributed through phishing attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)SuperOps[1] [2] In these attack cases, tools such as Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps were exploited.Syncro[1] [2] In these attack cases, tools such as Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps were exploited.