RMM Phishing Campaign: Malware Analysis

The campaign involves phishing operations that deliver legitimate RMM software (e.g., GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, ITarian) to victims after impersonating trusted entities like tax authorities and the Social Security Administration. It employs a reusable delivery kit with password-protected archives to evade detection, browser fingerprinting to identify targets, and Telegram for victim filtering. Infrastructure is highly dynamic, rotating across 240 hosts primarily using Vercel deployments, which provide legitimate TLS certificates and domain reputation, complicating detection and takedown efforts. The abuse of signed commercial RMM tools enables attackers to gain hands-on-keyboard access while bypassing signature-based security controls. The campaign is ongoing and global in scope.

The campaign enables attackers to gain unauthorized remote access to victim systems by abusing legitimate RMM software, potentially allowing extensive control over compromised environments. The use of trusted brands and signed software reduces detection likelihood and increases victim trust. The global scale and steady activity indicate a persistent threat with significant potential for data theft, espionage, or further malware deployment.

No official patch or fix applies as this is a phishing campaign abusing legitimate software. Detection should focus on behavioral indicators rather than signatures due to the use of signed commercial RMM tools. Organizations should educate users about phishing tactics involving password-protected archives and impersonation of trusted entities. Monitoring for unusual remote management sessions and restricting RMM software usage to authorized personnel and devices can help reduce risk. Review and harden email filtering and implement multi-factor authentication where possible. Vendor-managed remediation is not applicable as this is an abuse of legitimate software rather than a software vulnerability.