Huntress Reports Attackers Chaining Multiple RMM Tools in Phishing Attacks
Summary
Huntress describes incidents where phishing-led access through tools such as GoTo Resolve or PDQ enabled attackers to install additional RMM software, including ScreenConnect and SimpleHelp, for continued access. Its SOC says it stopped the reported attacks.
Key points
- Huntress observed attackers using phishing lures to install rogue GoTo Resolve or PDQ instances, then deploying secondary RMM tools such as ScreenConnect or SimpleHelp.
- In one case, a real estate company employee opened a disguised GoTo Resolve installer; the attacker then installed ScreenConnect.
- In another incident, PDQ was used to install a SimpleHelp instance configured to connect to stsmithchurchitems[.]shop.
- A reported October attack chained GoTo Resolve, SimpleHelp, and ScreenConnect, with the latter configured to use support[.]innerschapel[.]com.
- Lures included purported contract documents, social security statements, invitations, and bid transcripts; Huntress also reported rogue ITarian and Atera instances.
- Huntress says its SOC intervened in the described incidents, including isolating a host in one case, but gives no broader remediation status.
- Recommended defenses include maintaining an application inventory, restricting unauthorized RMM software, auditing approved RMM use, and reviewing execution logs.
Article Details
- Event Type
- Huntress reported multiple incidents in which threat actors used phishing and social engineering to install rogue remote monitoring and management (RMM) tools, often chaining multiple RMM products for access and persistence.
- Impact
- Affected users and organizations included a real estate company, an investment firm, a car dealer, and other businesses. Rogue RMM installations enabled unauthorized access and attempted persistence. Huntress says its SOC stopped or contained the described attacks and worked with impacted businesses on remediation; the article does not report data theft or other specific downstream harm.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | abre[.]ai | Huntress identified this domain as the download source for a rogue GoTo Resolve installer. |
| DOMAIN | deuwre[.]com | Recently registered domain configured for a rogue ScreenConnect instance installed during an attack. |
| DOMAIN | elegantparty[.]de | Huntress identified this domain as the download source for a file that led to installation of a renamed PDQ installer in an attack. |
| DOMAIN | ssaaccount-helper[.]icu | Source domain for a rogue ITarian installer presented through a purported Social Security statement lure. |
| DOMAIN | stsmithchurchitems[.]shop | Domain configured for a malicious SimpleHelp instance installed during an attack. |
| DOMAIN | support[.]innerschapel[.]com | Domain configured for a malicious ScreenConnect instance installed in an attack. |
| DOMAIN | wilkensealsivc[.]shop | Domain configured for a rogue ScreenConnect instance deployed after a malicious GoTo Resolve installation. |
| DOMAIN | xtroloozyanimailfeeddeals[.]shop | Domain configured for a rogue SimpleHelp instance installed during an attack. |
| URL | hxxps[:]//auctechnologies[.]com/revv/index%20(1).html | URL identified as the download source for a phishing-delivered rogue GoTo Resolve instance. |
| URL | hxxps[:]//con[.]wepivifllc[.]de/Bin/ReadAdobe_MICR0S0FTxxPDF.ClientSetup.msi | Remote URL used to download and execute a rogue ScreenConnect installer. |
| URL | hxxps[:]//pub-0e9274b4f4a74997bcafd5c5c778bf91[.]r2[.]dev/Thanksgiving-iv.exe | Specific URL identified as the download location for a malicious GoTo Resolve installer. |
MITRE ATT&CK
T1053.005 · Scheduled TaskA Windows Scheduled task was created to start the GoTo Resolve service for persistence.T1218.007 · MsiexecA rogue ScreenConnect installer was downloaded and executed with msiexec.T1219 · Remote Access ToolsThreat actors deployed and chained remote access software, including GoTo Resolve, ScreenConnect, PDQ, SimpleHelp, and ITarian, for unauthorized access and persistence.T1566.002 · Spearphishing LinkPhishing messages and lures induced users to download and execute rogue RMM installers.
Products
AteraThese incidents have involved all kinds of RMM platforms, including ScreenConnect, TeamViewer, Atera, NinjaRMM, and more.Chrome Remote DesktopThe SOC also sees a number of other RMM types, such as malicious Chrome Remote Desktop, Atera, and ITarian instances.GoTo Resolveemerge in this attack chain involving RMM tools: incidents that start with threat actors using PDQ or GoTo Resolve in order to then deploy secondary RMM tools, such as ScreenConnect or SimpleHelp.ITarianThe SOC also sees a number of other RMM types, such as malicious Chrome Remote Desktop, Atera, and ITarian instances.Microsoft TeamsThe Fake Bid Transcript: On October 15, a phishing message purporting to contain a Bid Transcript from Microsoft Teams duped a user into downloading and executing the file Contract Revised.exe, as seen in Figure 6 below.Mozilla FirefoxThe victim’s Firefox browser artifacts revealed that this installer was downloaded from the URL https[:]//pub-0e9274b4f4a74997bcafd5c5c778bf91[.]r2[.]dev/Thanksgiving-iv.exe.OutlookOn October 7, an employee at a real estate company received a phishing email through Outlook, which led to them installing Open Revised Contract (2).exe.PDQpattern emerge in this attack chain involving RMM tools: incidents that start with threat actors using PDQ or GoTo Resolve in order to then deploy secondary RMM tools, such as ScreenConnect or SimpleHelp.ScreenConnectThese incidents have involved all kinds of RMM platforms, including ScreenConnect, TeamViewer, Atera, NinjaRMM, and more.SimpleHelpactors using PDQ or GoTo Resolve in order to then deploy secondary RMM tools, such as ScreenConnect or SimpleHelp.
Industries
InvestmentIn September, a user at an investment firm downloaded a file (C:\Users\REDACTED\Downloads\276Special%10Invitation9756.msi) from hxxp[://]elegantparty[.]de, which led to the download of a renamed PDQ Installer.real estateOn October 7, an employee at a real estate company received a phishing email through Outlook, which led to them installing Open Revised Contract (2).exe.