A warning has been issued by the Cybersecurity and Infrastructure Security Agency, National Security Agency, and Multi-State Information Sharing and Analysis Center to alert network defenders about the malicious use of legitimate remote monitoring and management software. In October 2022, CISA discovered a cyberattack that had been conducted using reliable RMM software such as ScreenConnect and AnyDesk. The attackers had tricked victims into downloading the software, which they then used to steal money from their bank accounts through refund fraud. They could then sell the access to other cybercriminals or advanced persistent threat actors. The attackers were able to bypass security controls and risk management assumptions by using portable executables of RMM software, which allowed them to gain local user access without needing administrative privilege or full software installation. It was found that two FCEB networks may have been targeted by malicious activity, with an executable being downloaded when a recipient visited a first-stage malicious domain. This executable then connected to a malicious domain in the second stage, from which it downloaded other RMM software. The attackers did not install the downloaded RMM clients on the compromised host, but instead used AnyDesk and ScreenConnect as self-contained, portable executables that were configured to connect to their RMM server. The attackers then used the RMM software to start a refund scam, connecting to the victim's system and then luring them into logging into their bank account while still connected. The bank account summary was then changed by the attackers, showing that the victim had been mistakenly refunded an excess amount of money, which they were instructed to refund to the scam operator. Threat actors often target authorized RMM software users, such as managed service providers and IT help desks, who use the software for network administration, endpoint monitoring, endpoint management, and remote host interaction for IT support tasks. This allows the attackers to exploit trust relationships in MSP networks and gain access to many of the victim MSPs customers.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 03 Feb 2023 08:45:03 +0000