Phishing-to-RMM Attacks: The Remote Access Blind Spot CISOs Can’t Ignore
Threat actors are increasingly leveraging phishing campaigns to deliver legitimate Remote Monitoring and Management (RMM) tools like ScreenConnect and LogMeIn Rescue, bypassing traditional malware defenses. These attacks often utilize compromised domains, SEO injection, and VBS scripts to weaken endpoint controls (e.g., SmartScreen, Defender) before silently installing the RMM payload, creating significant visibility gaps for SOC teams.
Authors: ANY.RUN
- domainantibotsl[.]comPhishing domain
- domaincassablscq[.]com[.]esPhishing domain observed in campaign
- domaingreenmedicare[.]comCompromised domain used in attack chain
- domainjtprotherapy[.]screenconnect[.]comScreenConnect infrastructure observed receiving connections from compromised endpoint
- domainldgroups[.]comPhishing domain
- domainrakteam[.]xyzPhishing domain observed in campaign
- domainsewingshedstroud[.]co[.]ukPhishing domain observed in campaign
- domaintekkocaeli[.]comPhishing domain observed in campaign
- domainvmail[.]app[.]n8n[.]cloudLegitimate n8n cloud infrastructure abused for phishing
- filenameAdobe_Reader_Access_Document.vbsMalicious VBS script used to weaken defenses and install RMM
- ip104[.]21[.]36[.]162Resolves to phishing domain antibotsl.com
- ip15[.]204[.]108[.]149Resolves to jtprotherapy.screenconnect.com
- ip51[.]89[.]242[.]48Hosts ScreenConnect MSI payload
- urlhxxp://51[.]89[.]242[.]48:8040/Bin/ScreenConnect[.]ClientSetup[.]msiDirect download URL for ScreenConnect payload
- urlhxxps://antibotsl[.]com/adobe/microsoft_store.phpFake Microsoft Store/Adobe phishing page delivering RMM payload
- urlhxxps://ldgroups[.]com/Adobe/windows.phpFake Adobe page delivering malicious VBS script
- urlhxxps://vmail[.]app[.]n8n[.]cloud/webhook/43976209-fb4f-47ce-9c4a-8ee44127dfa0Fake OneDrive phishing page hosted on legitimate n8n cloud infrastructure delivering ScreenConnect
Detection / Hunter
What Happened
Cyber attackers are tricking people into downloading legitimate remote access software by using fake Microsoft, Adobe, and OneDrive login pages. This affects organizations across various industries, especially those in the US, Canada, Europe, and Australia. This matters because the tools being installed are not technically viruses, making them much harder for standard security software to detect and block. Organizations should monitor for unusual downloads of remote access tools and investigate the context of how these tools are being installed on employee computers.
Key Takeaways
- Threat actors are increasingly using phishing to deliver legitimate RMM tools (ScreenConnect, LogMeIn Rescue) to bypass traditional malware detection.
- Attacks leverage trusted infrastructure, compromised websites, and SEO injection rather than newly registered domains.
- Detection requires analyzing the full attack chain (phishing lure, download context, execution behavior) rather than relying solely on file or domain reputation.
- Advanced delivery methods include VBS scripts that elevate privileges, disable SmartScreen, and weaken Microsoft Defender before silently installing RMM agents.
Affected Systems
- Windows OS
- Organizations using or allowing RMM tools (Education, Technology, Banking, Government, Manufacturing, Finance)
Attack Chain
The attack begins with a phishing email directing the victim to a fake software update or document portal (e.g., Adobe, OneDrive) hosted on compromised or abused legitimate infrastructure. The victim is tricked into downloading an executable or a VBS script disguised as a legitimate file. Upon execution, the VBS script elevates privileges, disables SmartScreen, and weakens Microsoft Defender. Finally, the script silently downloads and installs a legitimate RMM tool like ScreenConnect or LogMeIn Rescue via msiexec, granting the attacker persistent remote access.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: ANY.RUN, Suricata
ANY.RUN provides a Suricata rule (ID 84002229) and custom Threat Intelligence Lookup queries (e.g., threatName:"^phishing$" and threatName:"rmm-tool") to track these campaigns.
Detection Engineering Assessment
EDR Visibility: Medium — EDRs may ignore the final RMM payload if it is a trusted, signed application, but they should catch the intermediate steps like VBS scripts spawning msiexec or modifying Defender settings. Network Visibility: Medium — Network traffic to legitimate RMM infrastructure (e.g., screenconnect.com) blends in with normal traffic, but the initial download from suspicious or compromised domains can be detected. Detection Difficulty: Hard — The use of legitimate RMM tools and compromised domains makes it difficult to distinguish malicious activity from normal IT administration without deep behavioral context.
Required Log Sources
- Process Creation (Event ID 4688 / Sysmon Event ID 1)
- File Creation (Event ID 11)
- Registry Modifications (Event ID 12/13/14)
- Network Connections (Sysmon Event ID 3)
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for unexpected execution of msiexec.exe spawned by script interpreters (wscript.exe, cscript.exe) installing known RMM software. | Process Creation | Execution | Low |
| Identify script executions (VBS) that are immediately followed by registry modifications targeting Windows Defender or SmartScreen. | Process Creation, Registry Modifications | Defense Evasion | Low |
| Monitor for RMM tools (ScreenConnect, LogMeIn) establishing network connections to unusual or newly observed remote subdomains. | Network Connections | Command and Control | Medium |
Control Gaps
- Domain reputation filtering (attackers use compromised/legitimate domains)
- Signature-based AV (payloads are legitimate signed RMM tools)
Key Behavioral Indicators
- VBS scripts modifying Defender/SmartScreen registry keys
- Browsers downloading executables disguised as PDFs or standard software updates
- msiexec.exe running with silent flags shortly after script execution
False Positive Assessment
- High - Legitimate IT administrators frequently install and use RMM tools like ScreenConnect and LogMeIn Rescue, which will trigger behavioral alerts if not properly tuned to the organization's baseline.
Recommendations
Immediate Mitigation
- Block execution of unauthorized RMM tools using AppLocker or WDAC.
- Investigate recent installations of ScreenConnect, LogMeIn Rescue, and other RMM tools for unauthorized access.
Infrastructure Hardening
- Implement strict application control policies to only allow approved RMM tools.
- Restrict outbound network connections to known, approved RMM infrastructure.
User Protection
- Configure endpoint security to block or aggressively prompt on the execution of VBS scripts downloaded from the internet.
- Enable Tamper Protection in Microsoft Defender to prevent scripts from disabling AV.
Security Awareness
- Train employees to recognize fake software update prompts and file-sharing portals (e.g., fake Adobe or OneDrive pages).
- Educate users that legitimate documents (PDFs) should not require downloading an executable or script to view.
MITRE ATT&CK Mapping
- T1566.002 - Phishing: Spearphishing Link
- T1036.005 - Masquerading: Match Legitimate Name or Location
- T1059.005 - Command and Scripting Interpreter: Visual Basic
- T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control
- T1562.001 - Impair Defenses: Disable or Modify Tools
- T1218.007 - System Binary Proxy Execution: Msiexec
- T1219 - Remote Access Software
Additional IOCs
- Ips:
104[.]21[.]36[.]162- Resolves to phishing domain antibotsl.com15[.]204[.]108[.]149- Resolves to jtprotherapy.screenconnect.com51[.]89[.]242[.]48- Hosts ScreenConnect MSI payload
- Domains:
antibotsl[.]com- Phishing domainvmail[.]app[.]n8n[.]cloud- Legitimate n8n cloud infrastructure abused for phishingldgroups[.]com- Phishing domainrakteam[.]xyz- Phishing domain observed in campaigntekkocaeli[.]com- Phishing domain observed in campaignsewingshedstroud[.]co[.]uk- Phishing domain observed in campaigncassablscq[.]com[.]es- Phishing domain observed in campaigngreenmedicare[.]com- Compromised domain used in attack chain
- Urls:
hxxp://51[.]89[.]242[.]48:8040/Bin/ScreenConnect.ClientSetup.msi- Direct download URL for ScreenConnect payload
- Command Lines:
- Purpose: Silent installation of RMM tool | Tools:
msiexec.exe| Stage: Execution |msiexec /i
- Purpose: Silent installation of RMM tool | Tools:
- Other:
suricataID:"84002229"- ANY.RUN Suricata rule ID for tracking this campaign
