U.S. Federal Agencies Fall Victim to Cyber Attack Utilizing Legitimate RMM Software

Jan 26, 2023Ravie LakshmananCyber Threat / Phishing

At least two federal agencies in the U.S. fell victim to a
“widespread cyber campaign” that involved the use of legitimate
remote monitoring and management (RMM) software to perpetuate a
phishing scam.

“Specifically, cyber criminal actors sent phishing emails that
led to the download of legitimate RMM software – ScreenConnect (now
ConnectWise Control) and AnyDesk – which the actors used in a
refund scam to steal money from victim bank accounts,” U.S.
cybersecurity authorities said^[1].

The joint advisory comes from the Cybersecurity and
Infrastructure Security Agency (CISA), National Security Agency
(NSA), and Multi-State Information Sharing and Analysis Center
(MS-ISAC).

The attacks, which took place in mid-June and mid-September
2022, have financial motivations, although threat actors could
weaponize the unauthorized access for conducting a wide range of
activities, including selling that access to other hacking
crews.

Usage of remote software by criminal groups has long been a
concern as it offers an effective^[2]
pathway^[3]
to establish local user access on a host without the need for
elevating privileges or obtaining a foothold by other means.

In one instance, the threat actors sent a phishing email
containing a phone number to an employee’s government email
address, prompting the individual to a malicious domain. The
emails, CISA said, are part of help desk-themed social engineering
attacks orchestrated by the threat actors since at least June 2022
targeting federal employees.

The subscription-related missives either contain a “first-stage”
rogue domain or engage in a tactic known as callback phishing^[4]
to entice the recipients into calling an actor-controlled phone
number to visit the same domain.

Irrespective of the approach used, the malicious domain triggers
the download of a binary that then connects to a second-stage
domain to retrieve the RMM software in the form of portable
executables.

The end goal is to leverage the RMM software to initiate a
refund scam. This is achieved by instructing the victims to login
to their bank accounts, after which the actors modify the bank
account summary to make it appear as though the individual was
mistakenly refunded an excess amount of money.

In the final step, the scam operators urge the email recipients
to refund the additional amount, effectively defrauding them of
their funds.

CISA attributed the activity to a “large trojan operation”
disclosed^[5]
by cybersecurity firm Silent Push in October 2022. That said,
similar telephone-oriented attack delivery methods have been
adopted by other actors, including Luna Moth^[6]
(aka Silent Ransom).

“This campaign highlights the threat of malicious cyber activity
associated with legitimate RMM software: after gaining access to
the target network via phishing or other techniques, malicious
cyber actors — from cybercriminals to nation-state sponsored APTs —
are known to use legitimate RMM software as a backdoor for
persistence and/or command and control (C2),” the agencies
warned.