Fake MicroDicom Site Distributed Installer With Persistent SSH Backdoor
Summary
Huntress found a fake MicroDicom site distributing an oversized installer that bundled OpenSSH and installed a persistent service and SSH tunnel. The activity affected endpoints at two medical organizations; no data theft is reported.
Key points
- Huntress detected suspicious SSH connections on endpoints at two medical organizations after a MicroDicom viewer installer was run.
- The malicious installer was 178 MB, compared with 13 MB for the legitimate installer; analysts found bundled OpenSSH and an additional binary.
- A dropped temporary file installed OpenSSH and registered UpdaterSvc.exe to run at system startup; 7655.bat created the SSH tunnel.
- Analysts traced the download to a cloned MicroDicom website, mlcrodlcom[.]info, which served the malicious installer from an Amazon S3 bucket.
- Huntress said the attackers may have used phishing tied to a June 2024 CISA advisory to steer users toward a fake patched version.
- The article describes the tunnel as a potential route for remote shell access and further malicious activity; it does not report confirmed data theft.
Article Details
- Attack Vectors
- A fake MicroDicom website distributed a malicious installer disguised as a patched version of the viewer.
- The malicious installer bundled OpenSSH and installed UpdaterSvc.exe as a service configured to start with the host.
- UpdaterSvc.exe ran 7655.bat to create an SSH tunnel to an attacker-used server, enabling remote shell access.
- Huntress believes attackers may have used phishing emails referencing the CISA advisory to direct users to the fake download site.
- Defensive Notes
- Huntress isolated an endpoint after detecting suspicious SSH activity.
- Verify software downloads against the manufacturer's official website; the malicious installer was substantially larger than the genuine installer.
- Investigate unexpected SSH connections and newly installed services, including UpdaterSvc.exe and the 7655.bat batch file.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | macrodicom[.]info | Similar-name domain registered after the CISA advisory and identified by Huntress among sites that may have been intended to phish users seeking updates. |
| DOMAIN | microdlcom[.]info | Similar-name domain registered after the CISA advisory and identified by Huntress among sites that may have been intended to phish users seeking updates. |
| DOMAIN | mlcrodicom[.]info | Similar-name domain registered after the CISA advisory and identified by Huntress among sites that may have been intended to phish users seeking updates. |
| DOMAIN | mlcrodlcom[.]info | Fake site identified by Huntress as responsible for directing users to the malicious installer. |
MITRE ATT&CK
T1021.004 · SSHThe malicious installer bundled OpenSSH and used an SSH tunnel to provide remote shell access to the affected host.T1059.003 · Windows Command ShellThe installed application ran 7655.bat, a batch file that created the SSH tunnel.T1543.003 · Windows ServiceThe installer registered UpdaterSvc.exe as a service that starts when the host starts.T1566.002 · Spearphishing LinkHuntress believed attackers may have sent phishing emails urging users to download a fake patched version from the malicious site.