More RMM Tools In the Wild, (Tue, Oct 6th)

This threat involves the abuse of the Action1 Remote Management & Monitoring (RMM) tool by threat actors. The attack starts with a phishing email containing a PDF invoice that uses an embedded OpenAction URI to redirect the victim to a malicious VBS script hosted on a malicious URL. The VBS script downloads and installs an MSI package containing the Action1 RMM tool signed by Action1 Corporation, which installs itself as a persistent service named 'A1Agent'. The tool connects to Action1's cloud infrastructure, likely using a free or test account, enabling attackers to remotely manage compromised systems. This technique leverages legitimate software and cloud infrastructure to evade detection and maintain persistence.

The impact is the unauthorized remote management and monitoring of compromised systems by threat actors using legitimate RMM software. This can lead to persistent access, potential data exfiltration, lateral movement, and further compromise within victim environments. The use of legitimate signed software and cloud infrastructure complicates detection and mitigation efforts.

No official patch is applicable since this is an abuse of legitimate software rather than a software vulnerability. Mitigation should focus on user awareness to avoid phishing emails with malicious PDFs, monitoring for unusual use of RMM tools like Action1, and restricting installation of unauthorized software. Organizations should verify the legitimacy of RMM tool deployments and monitor network connections to known Action1 infrastructure. Since the threat actors likely use free or test accounts, vendors and organizations should monitor for suspicious account activity. Patch status is not applicable; check vendor advisories for updates on abuse prevention.