PowerShell RAT Campaign Uses Phishing and Dual RMM Tools to Target U.S. SLTT Networks
Summary
CIS reports an active phishing campaign targeting U.S. state, local, tribal, and territorial networks with a PowerShell WebSocket RAT and ScreenConnect and Pulseway RMM tools for persistent access.
Key points
- CIS identified four evolving campaign variants and observed command-and-control beaconing across multiple U.S. SLTT networks.
- Phishing emails abuse legitimate Google Drive share notifications, while lure pages and payloads are hosted on Google Cloud Storage.
- The campaign uses a custom PowerShell WebSocket RAT for operator commands before installing ScreenConnect and Pulseway for persistent remote access.
- Variants add encrypted command-and-control, a UAC bypass, and randomized payload builds; earlier versions use techniques including scheduled-task persistence.
- CIS assesses the campaign is almost certainly related to a financially motivated freight-fraud operation previously documented by Proofpoint.
- CIS says the activity likely extends beyond transportation and logistics and recommends SLTT organizations use its shared threat intelligence and defensive services.
Article Details
- Attack Vectors
- Phishing emails abused Google Drive share notifications and directed recipients to fake DocuSign pages that delivered VBS droppers.
- VBS droppers delivered or assembled PowerShell WebSocket RATs; one variant used an MSI installer to run the RAT in memory.
- The RAT used scheduled-task or registry Run-key persistence in some variants, then enabled operator commands and installation of ScreenConnect and Pulseway.
- Variant 4 used a multi-stage fetch-and-stage chain, encrypted WebSocket C2, a COM elevation-moniker UAC bypass, and per-build payload randomization.
- Defensive Notes
- CIS recommends U.S. SLTT organizations join the MS-ISAC and use its proactive web security service, MDBR.
- The article reports that the RMM installers were legitimately signed and passed standard AV and EDR signature checks.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | instantotification[.]com | Attacker-controlled typosquatting domain used to create Google accounts for phishing. |
| DOMAIN | safeandtrustedconnections[.]com | Attacker-controlled domain used to create Google accounts for phishing. |
| DOMAIN | thehealingpc[.]pulseway[.]com | Pulseway tenant to which the campaign's client enrolled; described as the CTA tenant. |
| HOSTNAME | mgnajgk2[.]anondns[.]net | C2 configured for the ScreenConnect client installed by the campaign. |
| IPV4 | 172[.]86[.]108[.]91 | C2 server used by the PowerShell WebSocket RAT. |
| IPV4 | 45[.]61[.]163[.]253 | C2 server used by the PowerShell WebSocket RAT. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign used obfuscated VBS, Base64-encoded PowerShell, and XOR-encoded loader content.T1053.005 · Scheduled TaskVariant 1 established persistence with a scheduled task named TabOpenerAgent.T1059.001 · PowerShellThe droppers invoked PowerShell, and the RAT executed operator-supplied commands through PowerShell.T1071.001 · Web ProtocolsThe RAT communicated with its C2 over WebSocket, including encrypted WebSocket in Variant 4.T1105 · Ingress Tool TransferThe dropper and lure page retrieved loaders or RAT content from GCS staging buckets.T1218.007 · MsiexecThe operators used msiexec to silently install the ScreenConnect and Pulseway MSI packages.T1219 · Remote Access ToolsThe operators installed ScreenConnect and Pulseway for persistent remote access.T1547.001 · Registry Run Keys / Startup FolderA registry Run key named GoogleChromeAutoStart served as fallback persistence.T1548.002 · Bypass User Account ControlVariant 4 used a COM elevation-moniker UAC bypass to relaunch with administrative privileges without a UAC prompt.T1566.002 · Spearphishing LinkPhishing emails used Google Drive share notifications to deliver lures.
Vendors
ConnectWiseThe ScreenConnect (ConnectWise) client is configured for covert unattended access with all notifications disabled and its C2 set to mgnajgk2.anondns[.]net:8041; its Client_Override resources rebrand it as “Session” withGoogleThe campaign also abuses legitimate Google Drive share notifications to bypass email authentication, hosts lure pages and payloads on Google Cloud Storage (GCS), and uses the WebSocket RAT to enable real-timePulsewaypreviously documented by Proofpoint Threat Research based on an exact SHA256 hash match between the Pulseway installer and multiple overlapping delivery, command and control (C2), and dual-RMM tradecraft.
Products
Google Cloud StorageGoogle Drive share notifications to bypass email authentication, hosts lure pages and payloads on Google Cloud Storage (GCS), and uses the WebSocket RAT to enable real-time hands-on-keyboard operator interaction priorGoogle DriveThe campaign also abuses legitimate Google Drive share notifications to bypass email authentication, hosts lure pages and payloads on Google Cloud Storage (GCS), and uses the WebSocket RAT to enable real-timePulsewaypreviously documented by Proofpoint Threat Research based on an exact SHA256 hash match between the Pulseway installer and multiple overlapping delivery, command and control (C2), and dual-RMM tradecraft.ScreenConnectalso shared the VBS dropper, two PowerShell WebSocket RATs and associated logs, and the Pulseway and ScreenConnect RMMs the CTAs installed after the member detonated the phishing emails in a controlled sandbox.
Countries
Industries
GovernmentState, Local, Tribal, and Territorial (SLTT) government networks by delivering a custom PowerShell WebSocket remote access trojan (RAT) followed by dual remote monitoring and management (RMM) tools for persistent access.Transportation and LogisticsCIS CTI assesses it is almost certainly the same campaign Proofpoint Threat Research documented targeting the transportation and logistics sector in February and March 2026.