CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

guest · Jan 25, 2023

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software
January 25, 2023

Today, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released joint Cybersecurity Advisory (CSA) Protecting Against Malicious Use of Remote Monitoring and Management Software. The advisory describes a phishing scam in which cyber threat actors maliciously use legitimate remote monitoring and management (RMM) software to steal money from victim bank accounts.
Click to expand...

CISA encourages network defenders to review the advisory for indicators of compromise, best practices, and recommended mitigations, which highlights the threat of additional types of malicious activity using RMM, including its use as a backdoor for persistence and/or command and control (C2).
Click to expand...

guest · Jan 26, 2023

CISA says federal agencies attacked in refund scam through remote management software
By Jonathan Greig @jgreigj - January 25, 2023

At least two federal civilian agencies were exploited by cybercriminals as part of a refund scam campaign perpetrated through the use of remote monitoring and management (RMM) software.
Click to expand...

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency, and Multi-State Information Sharing and Analysis Center (MS-ISAC) said on Wednesday they discovered the campaign in October. One federal office was exploited in June and another was attacked in September.

“Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software — ScreenConnect (now ConnectWise Control) and AnyDesk — which the actors used in a refund scam to steal money from victim bank accounts,” CISA said. RMM software is typically used by IT departments as a way to get remote access to a computer.
“They first connected to the recipient’s system and enticed the recipient to log into their bank account while remaining connected to the system. The actors then used their access through the RMM software to modify the recipient’s bank account summary. The falsely modified bank account summary showed the recipient was mistakenly refunded an excess amount of money. The actors then instructed the recipient to ‘refund’ this excess amount to the scam operator.”
Click to expand...

In the June incident, a phishing email with a phone number was sent to a government employee address. The employee called the number and was sent to myhelpcare[.]online.
The September incident, meanwhile, contained a link to a malicious domain.

From there, the hackers downloaded AnyDesk and ScreenConnect as “self-contained, portable executables” that were then configured to connect to the actor’s RMM server. CISA noted that the hackers did not install the downloaded RMM software onto the victim devices, instead using portable executables that can launch within a user’s device without installation.

“Because portable executables do not require administrator privileges, they can allow execution of unapproved software even if a risk management control may be in place to audit or block the same software’s installation on the network,” CISA explained.
Click to expand...

Log in or Sign up

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

guest Guest

guest Guest

Log in or Sign up

CISA, NSA, and MS-ISAC Release Advisory on the Malicious Use of RMM Software

guest Guest

guest Guest

Useful Searches