ScreenConnect

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

That link leads to a compromised WordPress website hosting a convincing fake Adobe page designed to trick users into triggering a malware download without realizing it.

The campaign works by sending phishing emails that look like legitimate Adobe Document Cloud file-sharing notifications. Victims are told a confidential project document has been uploaded to Adobe Document Cloud and are given a link to view it.

The intrusion chain likely begins with a social engineering or phishing-based delivery mechanism distributing a malicious PowerShell payload disguised as a legitimate JPEG image file named sysupdate.jpeg through phishing emails, malicious attachments, deceptive cloud-sharing links, fake software updates, or user-driven download interactions.

MuddyWater began using "fully signed" and legitimate RMM tools as part of its attack chain in 2020, often by including links in phishing emails designed to trick victims into downloading and executing RMM installers.

The malware uses the root\SecurityCenter2 namespace to silently retrieve installed security product names, executable paths, and operational states.

DLL sideloading (T1574.001) is a technique in which attackers place a malicious DLL in a location that a legitimate application will load instead of the expected library... Among these is a malicious libvlc.dll, which, as a core dependency of vlc.exe, is sideloaded early in the application's execution. | Because Windows searches for DLLs in specific directories, the malicious DLL is loaded and executed when the trusted program starts.

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1543.003 - Create or Modify System Process: Windows Service. The Threat Actor created a ScreenConnect service.

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

Additional functions such as CreateProcessAsUser() and CreateRemoteProcess() capable of launching processes under alternate user tokens or remote sessions, alongside token manipulation APIs including DuplicateToken(), ImpersonateLoggedOnUser(), and EnableCurrentProcessPrivilege().

T1543.003 - Create or Modify System Process: Windows Service. The Threat Actor created a ScreenConnect service.

File names are customized to match the victim’s business context, such as using a company name in the installer file, making the download appear even more legitimate at first glance.

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

Additional functions such as CreateProcessAsUser() and CreateRemoteProcess() capable of launching processes under alternate user tokens or remote sessions, alongside token manipulation APIs including DuplicateToken(), ImpersonateLoggedOnUser(), and EnableCurrentProcessPrivilege().

The malicious DLL then uses msiexec.exe to silently install another malicious file named vcredist_x64.dll, disguised as a Visual C++ Redistributable package.

The malware additionally evaluates processor counts, machine manufacturers, and virtual machine indicators to identify sandboxed or virtualized analysis environments and reduce exposure to automated malware analysis systems.

Persistence T1564.001 Hide Artifacts: Hidden Files and Directories Hidden staging inside C:\Systems and invisible accounts using showInLogon=false

DLL sideloading (T1574.001) is a technique in which attackers place a malicious DLL in a location that a legitimate application will load instead of the expected library... Among these is a malicious libvlc.dll, which, as a core dependency of vlc.exe, is sideloaded early in the application's execution. | Because Windows searches for DLLs in specific directories, the malicious DLL is loaded and executed when the trusted program starts.

Credential Provider interception through named pipe IPC communication... The malware installs itself into the Windows authentication workflow and silently monitors login activity.

Credential Access T1056.001 Input Capture: Keylogging LowLevelKeyboardHooker leveraging SetWindowsHookEx()

The collected information includes: Logged-on usernames Active Directory domains Hostnames Operating system versions CPU model information Installed memory MAC addresses Internal IP addresses Hardware serial numbers Timezone information Last boot timestamps Raw screenshot data

The malware implements a multi-layer inheritance chain named GuestInfoMessage1-4 responsible for extensive victim profiling... The collected information includes: Logged-on usernames Active Directory domains...

The malware additionally evaluates processor counts, machine manufacturers, and virtual machine indicators to identify sandboxed or virtualized analysis environments and reduce exposure to automated malware analysis systems.

A second script named <Random-Text>run.cmd launches a hidden PowerShell command leveraging WMI to enumerate installed antivirus solutions... using the root\SecurityCenter2 namespace.

Malicious actors are using remote management and monitoring software to launch phishing attacks against federal employees... The attacks have leveraged otherwise legitimate RMM tools like ScreenConnect — now ConnectWise Control — and AnyDesk

Credential Provider interception through named pipe IPC communication... The malware installs itself into the Windows authentication workflow and silently monitors login activity.

Credential Access T1056.001 Input Capture: Keylogging LowLevelKeyboardHooker leveraging SetWindowsHookEx()

Recovered capabilities include: Real-time screen monitoring Continuous video recording... Figure 14 Decompiled SessionConnectionInfoAttributes capability flags exposing extensive attacker functionality including real-time screen surveillance.

Recovered capabilities include: ... Microphone surveillance ... Extensive Surveillance Features: The framework supported ... microphone interception, speaker audio capture.

Encrypted Command-and-Control: The malware established encrypted communications with attacker-controlled infrastructure hosted on legitserver.theworkpc[.]com over non-standard ports (5443 and 8041).

abuse this trusted software to transfer secondary malicious components directly

this helper module installs a packaged version of the commercial tool ScreenConnect ... abuse this trusted software to transfer secondary malicious components directly

Analysis confirmed that the malware uses a custom PBKDF2/HMAC-SHA256 based iterative key derivation mechanism to generate independent encryption keys and initialization vectors for inbound and outbound traffic channels.

RMM has become a more prominent vector for initial access, persistence, and data exfiltration

The SetSafeModeReboot() routine enables forced reboots into Safe Mode, where many security tools and endpoint protection solutions become inactive.