8 minhigh
Phishing Abuses RMM Tools for Persistent Access | Microsoft Security Blog
Unattributed phishing campaign distributes masqueraded MSP360 RMM installer to establish persistent access, then deploys ConnectWise ScreenConnect as a secondary remote channel for credential theft. MSP360 RMM agent services launch PowerShell to silently install ScreenConnect via msiexec, creating redundant remote access. ScreenConnect's RunFile feature delivers credential theft utilities under Windows-mimicking filenames to Documents\ScreenConnect\Temp. Actor-controlled domains and legitimate cloud services rotate delivery infrastructure. FaronicsDeployAgent.exe was also observed deploying ScreenConnect in a similar pattern.
Sens:▲ 24h
IOCs47
31sha2567domain4file path3registry key1sha11url
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block MSP360 RMM installer SHA256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc
- Block actor-controlled domains: adswre.cfd, trews.cfd, adsaw.cfd, and subdomains
- Hunt for MSP360 and ScreenConnect installations not approved by IT
- Reset credentials on systems where unauthorized RMM tools were installed
Key Takeaways
- MSP360 RMM v2.5.0.67 installer certificate has been revoked
- ScreenConnect installed silently via msiexec /qn from C:\Windows\Temp\ClientSetup.msi
- FaronicsDeployAgent.exe also observed deploying ScreenConnect in similar pattern
- Payloads hosted on Amazon S3, Cloudflare R2, Dropbox, GitLab, and Supabase
- ScreenConnect RunFile delivered 22+ utilities with Windows-mimicking filenames for credential theft
Attack Chain
- Initial Access: Phishing emails deliver signed MSP360 RMM installer under deceptive filenames
- Execution: Installer elevates via UAC, deploys MSP360 services and registry autorun entries
- Persistence: Windows services RMM.Agent.exe and RMM.Agent.Launcher.exe registered for startup
- C2: MSP360 agent launches PowerShell to download and silently install ScreenConnect via msiexec
- Credential Access: ScreenConnect RunFile transfers and executes credential theft utilities from Temp directories
Affected Systems
- Windows endpoints across multiple industries
- Systems where users can grant UAC elevation
- Environments without application allowlisting for RMM tools
- Users receiving phishing lures themed as meeting invitations
Detection Availability
- Published: KQL
- Platforms: Microsoft Defender XDR Advanced Hunting
Four KQL queries in Advanced hunting section for MSP360, PowerShell, ScreenConnect, and payload detection.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process trees, command lines, file operations, and service creation all visible via EDR telemetry. |
| Network Visibility | Medium | HTTPS traffic to actor-controlled domains visible but encrypted payloads limit content inspection. |
| Detection Difficulty | Moderate | Legitimate signed software abused, but unusual process chains and service creation patterns are detectable. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| RMM agent service spawning PowerShell to download and install MSI packages silently (T1059.001, T1218.007) | DeviceProcessEvents with parent RMM.Agent.exe | Execution | Low — RMM agents rarely spawn PowerShell for MSI downloads |
| ScreenConnect client executing files from user Documents ScreenConnect Temp directories (T1219, T1105) | DeviceProcessEvents with ScreenConnect RunFile | Execution | Low — ScreenConnect RunFile from Temp is unusual |
| New Windows services created with names matching RMM agent patterns (T1543.003) | Service creation events for RMM.Agent.exe | Persistence | Medium — legitimate RMM deployments create same services |
| Masqueraded executables with Windows-like names in ScreenConnect Temp directories (T1036.005) | DeviceFileEvents in ScreenConnect Temp paths | Defense Evasion | Low — non-standard Windows-named executables in Temp |
Required Log Sources
- DeviceProcessEvents
- DeviceFileEvents
- DeviceNetworkEvents
- Windows Event Log
- Registry modification events
- Firewall rule changes
Key Behavioral Indicators
- RMM.Agent.exe spawning powershell.exe for MSI downloads
- ScreenConnect.WindowsClient.exe RunFile from Documents Temp
- netsh firewall rule for UDP port 48678 by installer
- eventcreate with source MSP360 RMM Agent installer
- msiexec silent install from C:\Windows\Temp\ClientSetup.msi
- Masqueraded executables in ScreenConnect Temp directories
Control Gaps
- Application allowlisting gaps permit unapproved RMM tool installation
- Firewall rule creation by installer processes not monitored
- Legitimate signed software bypasses signature-based detection
- Cloud-hosted payload delivery evades domain-based blocking
- ScreenConnect RunFile execution not audited by default
False Positive Assessment
Medium — legitimate RMM software creates expected service and registry entries; distinguishing approved from unapproved deployments requires inventory context.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Enforce MFA on all approved RMM systems
- Use AppLocker publisher rules to block unapproved RMM software certificates
- Block inbound UDP port 48678 unless MSP360 is approved
- Enable Application Control for Windows to restrict signed software by publisher
User Protection
- Enable cloud-delivered protection in Microsoft Defender Antivirus
- Deploy ASR rule to block PsExec and WMI process creations
- Block MSP360 installer certificate using Defender for Endpoint block certificate action
- Monitor for UAC elevation prompts from downloaded executables
Security Awareness
- Train users to verify meeting invitations before downloading attachments
- Warn about fake software update prompts for Zoom, Adobe, and PDF readers
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping19 techniques
Tactic
Resource Development
Tactic
Initial Access
Tactic
Persistence
Tactic
Defense Impairment
Tactic
Discovery
Tactic
Collection
Plain-Language Summary
Attackers sent fake meeting invitations and software update notices to trick employees into downloading a legitimate remote management tool disguised as a business document. Once installed, this tool downloaded a second remote access program, giving attackers persistent control of the computer. They then used this access to steal passwords and collect information. Organizations should check for unauthorized remote management software and restrict which tools employees can install.
Additional IOCs
- File Hashes:
f34330d4c6e0aa978dc3af40360c14b31ad51127(SHA1) - MSP360 RMM v2.5.0.67 installer under deceptive filenamesf094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97(SHA256) - MSP360 RMM Agent Service binary observed in campaign857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3(SHA256) - MSP360 RMM Agent Service binary observed in campaign6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e(SHA256) - MSP360 RMM Agent Service binary observed in campaign4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26(SHA256) - MSP360 RMM Agent Service binary observed in campaignceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0(SHA256) - Post-compromise utility delivered via ScreenConnect session02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550(SHA256) - Post-compromise utility delivered via ScreenConnect session499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a(SHA256) - Post-compromise utility delivered via ScreenConnect sessiond49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdc(SHA256) - Post-compromise utility delivered via ScreenConnect session67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55(SHA256) - Post-compromise utility delivered via ScreenConnect session6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc(SHA256) - Post-compromise utility delivered via ScreenConnect session40f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1(SHA256) - Post-compromise utility delivered via ScreenConnect session3ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096(SHA256) - Post-compromise utility delivered via ScreenConnect session374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187(SHA256) - Post-compromise utility delivered via ScreenConnect sessionbc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6c(SHA256) - Post-compromise utility delivered via ScreenConnect sessionc2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208(SHA256) - Post-compromise utility delivered via ScreenConnect session5bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b(SHA256) - Post-compromise utility delivered via ScreenConnect session19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1(SHA256) - Post-compromise utility delivered via ScreenConnect sessiond232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db(SHA256) - Post-compromise utility delivered via ScreenConnect sessiond3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53ef(SHA256) - Post-compromise utility delivered via ScreenConnect sessione31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3(SHA256) - Post-compromise utility delivered via ScreenConnect session1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8(SHA256) - Post-compromise utility delivered via ScreenConnect session77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a(SHA256) - Post-compromise utility delivered via ScreenConnect sessionfc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2(SHA256) - Post-compromise utility delivered via ScreenConnect session06ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b(SHA256) - Post-compromise utility delivered via ScreenConnect sessiona93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657(SHA256) - Post-compromise utility delivered via ScreenConnect session529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63(SHA256) - Post-compromise utility delivered via ScreenConnect sessionccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88(SHA256) - Post-compromise utility delivered via ScreenConnect sessiona03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b(SHA256) - Post-compromise utility delivered via ScreenConnect session37ffc7103dad8651866df049ea29b6c4d1bd70fefcda4232bb4ee5f647828ed5(SHA256) - WS Password.exe credential theft tool delivered via ScreenConnect
- Registry Keys:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RMM.Agent.exe- MSP360 RMM agent service registration keyHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RMM.Agent.Launcher.exe- MSP360 RMM launcher service registration keyHKEY_LOCAL_MACHINE\SOFTWARE\Classes\sc-a2274db645c550f8\shell\open\command- ScreenConnect protocol handler registry modification
- File Paths:
C:\Program Files\RMM Agent\- MSP360 RMM installation directory for agent binariesC:\Users\%user%\Documents\ScreenConnect\Temp\- ScreenConnect staging directory for attacker toolingC:\Users\%user%\OneDrive\Documents\ScreenConnect\Temp\- ScreenConnect staging directory in OneDrive pathC:\Windows\Temp\ClientSetup.msi- Downloaded ScreenConnect MSI package path
- Command Lines:
- Purpose: Create inbound firewall rule for MSP360 agent UDP port | Tools:
netsh.exe| Stage: Persistence |netsh advfirewall firewall add rule name= protocol=UDP localport= - Purpose: Silently install ScreenConnect MSI package without user interaction | Tools:
msiexec.exe| Stage: Execution |msiexec.exe /i <path> /qn - Purpose: Download ScreenConnect MSI from actor-controlled C2 server | Tools:
powershell.exe,Invoke-WebRequest| Stage: Execution |Invoke-WebRequest -Uri <url> -OutFile <path> - Purpose: Stop and delete existing RMM services before reinstalling | Tools:
sc.exe| Stage: Persistence |sc stop/delete <servicename> - Purpose: Enumerate installed .NET runtimes for prerequisite check | Tools:
dotnet| Stage: Discovery |dotnet --list-runtimes
- Purpose: Create inbound firewall rule for MSP360 agent UDP port | Tools:
Showing defanged values
- domainadsaw[.]cfdScreenConnect C2 domain contacted by client
- domainadswre[.]cfdScreenConnect C2 domain contacted by client
- domainbunstar[.]harej[.]siScreenConnect C2 domain contacted by client
- domainojsuyw[.]niyari[.]orgScreenConnect C2 domain contacted by client
- domainsdfghj[.]rd-team[.]ruScreenConnect C2 domain contacted by client
- domainswedcorry[.]stefneyv[.]comScreenConnect C2 domain contacted by client
- domaintrews[.]cfdScreenConnect C2 server and MSI download host
- file_pathC:\ProgramFiles\RMMAgent\MSP360 RMM installation directory for agent binaries
- file_pathC:\Users\%user%\Documents\ScreenConnect\Temp\ScreenConnect staging directory for attacker tooling
- file_pathC:\Users\%user%\OneDrive\Documents\ScreenConnect\Temp\ScreenConnect staging directory in OneDrive path
- file_pathC:\Windows\Temp\ClientSetup.msiDownloaded ScreenConnect MSI package path
- registry_keyHKEY_LOCAL_MACHINE\SOFTWARE\Classes\sc-a2274db645c550f8\shell\open\commandScreenConnect protocol handler registry modification
- registry_keyHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RMM.Agent.exeMSP360 RMM agent service registration key
- registry_keyHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RMM.Agent.Launcher.exeMSP360 RMM launcher service registration key
- sha1f34330d4c6e0aa978dc3af40360c14b31ad51127MSP360 RMM v2.5.0.67 installer under deceptive filenames
- sha25602f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550Post-compromise utility delivered via ScreenConnect session
- sha25606ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426bPost-compromise utility delivered via ScreenConnect session
- sha256108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dcMasqueraded MSP360 RMM installer distributed via phishing
- sha25619035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1Post-compromise utility delivered via ScreenConnect session
- sha2561a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8Post-compromise utility delivered via ScreenConnect session
- sha256374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187Post-compromise utility delivered via ScreenConnect session
- sha25637ffc7103dad8651866df049ea29b6c4d1bd70fefcda4232bb4ee5f647828ed5WS Password.exe credential theft tool delivered via ScreenConnect
- sha2563ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096Post-compromise utility delivered via ScreenConnect session
- sha25640f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1Post-compromise utility delivered via ScreenConnect session
- sha2564188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26MSP360 RMM Agent Service binary observed in campaign
- sha256499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156aPost-compromise utility delivered via ScreenConnect session
- sha256529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63Post-compromise utility delivered via ScreenConnect session
- sha2565bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971bPost-compromise utility delivered via ScreenConnect session
- sha25667c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55Post-compromise utility delivered via ScreenConnect session
- sha2566a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237eMSP360 RMM Agent Service binary observed in campaign
- sha2566cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bccPost-compromise utility delivered via ScreenConnect session
- sha25677fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27aPost-compromise utility delivered via ScreenConnect session
- sha256857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3MSP360 RMM Agent Service binary observed in campaign
- sha256a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5bPost-compromise utility delivered via ScreenConnect session
- sha256a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657Post-compromise utility delivered via ScreenConnect session
- sha256bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6cPost-compromise utility delivered via ScreenConnect session
- sha256c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208Post-compromise utility delivered via ScreenConnect session
- sha256ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88Post-compromise utility delivered via ScreenConnect session
- sha256ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0Post-compromise utility delivered via ScreenConnect session
- sha256d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126dbPost-compromise utility delivered via ScreenConnect session
- sha256d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53efPost-compromise utility delivered via ScreenConnect session
- sha256d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdcPost-compromise utility delivered via ScreenConnect session
- sha256dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64Credential theft utility WS PIN.exe delivered via ScreenConnect
- sha256e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3Post-compromise utility delivered via ScreenConnect session
- sha256f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97MSP360 RMM Agent Service binary observed in campaign
- sha256fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2Post-compromise utility delivered via ScreenConnect session
- urlhxxps://trews[.]cfd/Bin/ScreenConnect[.]ClientSetup[.]msi?e=Access&y=GuestScreenConnect MSI package download URL from C2