Huntress Finds Rogue ScreenConnect Access in Pharmacy and Healthcare Intrusions

Nov 9, 2023 · Original article ↗

Summary

Huntress traced unauthorized access on two healthcare-sector Windows servers to shared ScreenConnect access, followed by additional remote tools, payload delivery, reconnaissance and account creation. It could not determine whether the pharmaceutical vendor was breached

Key points

Huntress reported related activity on two Windows Server 2019 endpoints at separate organizations in the pharmaceutical and healthcare sectors.
The same ScreenConnect instance and account were observed on both endpoints. The instance was associated with rs.tdsclinical[.]com, linked to Transaction Data Systems (now Outcomes); Huntress could not determine whether the vendor was breached or how the access was connected.
The actor used ScreenConnect to install additional remote-access tools, including more ScreenConnect instances and AnyDesk, and to download files through PowerShell.
On one endpoint, a downloaded test.xml file containing C# code was launched with msbuild.exe. The payload was designed to load Meterpreter in memory; antimalware attempted to stop it, and further processes were observed through spoolsv.exe.
On the second endpoint, the actor created a local administrator account, transferred and launched Advanced IP Scanner, and ran commands involving mshta.exe and the WDigest registry setting.
Huntress also found an open directory containing additional tools and payloads, but said their connection to the observed incidents was uncertain.
Huntress urged potentially affected pharmacy and healthcare organizations to check their systems for the reported indicators and investigate any matches.

Article Details

Attack Vectors: Attackers used a locally hosted ScreenConnect instance associated with Transaction Data Systems/Outcomes to access victim organizations; Huntress could not determine whether the vendor was breached, credentials were leaked, or another mechanism enabled the access.
The actor installed additional ScreenConnect instances and AnyDesk to maintain remote access.
PowerShell downloaded MSI installers and test.xml from remote infrastructure; the MSI files were launched to install remote-access software.
The actor executed test.xml through msbuild.exe. The C# payload attempted to load Meterpreter in memory, although antimalware protections attempted to terminate it.
The actor created a local manager account, added it to the local Administrators group, and used it to reconnect.
The actor used mshta to execute a remote resource and changed the WDigest UseLogonCredential registry setting.
Observed reconnaissance included querying Active Directory computer objects and using nslookup to query myip.opendns.com.
Defensive Notes: Pharmacies and other healthcare organizations that may be clients of Transaction Data Systems/Outcomes should immediately examine systems and networks for the listed indicators and investigate any findings.
Use enhanced endpoint monitoring and proactive threat hunting; the article also recommends a comprehensive response because of potential patient-data, privacy, and service-availability implications.
Treat the relationship between the vendor and the observed activity as unresolved: Huntress could not establish whether Transaction Data Systems/Outcomes was breached or how its remote-management access was abused.

Indicators of compromise

Type	Indicator	Context
IPV4	`119[.]91[.]138[.]133`	Huntress identified this as primary infrastructure for storing and retrieving post-access payloads.
IPV4	`185[.]12[.]45[.]98`	Connecting server configured for malicious ScreenConnect instance D.
IPV4	`2[.]57[.]149[.]103`	Huntress identified this as the hosting server for the AnyDesk MSI installation and found an open directory containing additional potential attacker tools and payloads; some files' connection to the incidents is uncertain.
IPV4	`45[.]66[.]230[.]146`	Connecting server used by malicious ScreenConnect instance C.
SHA256	`174f91806e8bc1c0dea24192f7d4afcefc40a1731827b32939d4f411e8402d75`	Hash of Masscan64.exe, a compiled TCP port scanner found in the archive and described as a potential system-survey payload; it was not observed in monitored environments.
SHA256	`45c8716c69f56e26c98369e626e0b47d7ea5e15d3fb3d97f0d5b6e8997299d1a`	Hash of veeam.exe, an executable found in the archive that contains code to exploit CVE-2023-27532; the article notes its association with the observed activity is uncertain.
SHA256	`70f865a7f8a01356685b17abdf6ac738e9a9098f1ae2d5a34cfa3610cb28fc56`	Hash of a.msi, the AnyDesk installer used by the actor to establish remote access.
SHA256	`8c3b4febe58df0a01126d78109f52035d34a4e03f02b5d4fca3e4d94f3f657b3`	Hash of s.msi, the ScreenConnect installer transferred to endpoint 2 and used to install instance D.
SHA256	`9f42bf3a61faaab8f86abb3c7f9db417bffb3474a55169a4efb1d2386545e4e8`	Hash of test.xml, the C# payload designed to load Meterpreter into victim memory.
SHA256	`ba8521ef14f1ec09f0bcb8f490e30322ca4eb84fa0013ee3bbe9c6a24866d334`	Hash of t.zip, an archive found on the open directory containing additional executables; the article says its association with the monitored incidents is uncertain.
SHA256	`f28ee671c0f894154dd8c145f2b6b819b63348c785a682f60f37529a2aae174e`	Hash of b.msi, an additional ScreenConnect client installer found on the open directory; its association with the incidents is uncertain.
URL	`hxxp[:]//119[.]91[.]138[.]133:443/test.xml`	PowerShell download URL used to retrieve the C# payload on both endpoints.
URL	`hxxp[:]//119[.]91[.]138[.]133:9999/5E1Ch`	Remote resource passed to mshta by the actor.
URL	`hxxp[:]//2[.]57[.]149[.]103/a.msi`	PowerShell download URL used to retrieve the MSI that installed ScreenConnect instance C.
URL	`hxxps[:]//bashupload[.]com/PXYpf/a.msi`	Specific file URL used to download the MSI that installed the AnyDeskMSI Service.