Friday, June 14, 2024

Hackers Abuse Legitimate Remote Monitoring Tools to Steal Banking Data

A joint Cybersecurity Advisory (CSA) from the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) has been released to alert network defenders to malicious use of legitimate remote monitoring and management (RMM) software.

In October 2022, CISA discovered a massive cyberattack that made use of malicious RMM software that was legitimate.

In this campaign, cybercriminals utilized phishing emails to trick users into downloading reliable RMM software like ScreenConnect and AnyDesk, which they then exploited to steal money from victims’ bank accounts through refund fraud.

Also, the actors could sell victim account access to other cybercriminal or advanced persistent threat (APT) actors.

“Using portable executables of RMM software provides a way for actors to establish local user access without the need for the administrative privilege and full software installation—effectively bypassing common software controls and risk management assumptions”, CISA reports.

Overview Of the Malicious Cyber Activity

Based on a retrospective review of EINSTEIN, a federal civilian executive branch (FCEB)-wide intrusion detection system (IDS) operated and monitored by CISA it was discovered that two FCEB networks may have been the target of malicious activity.

  • An FCEB employee’s government email address received a phishing email with a phone number in the middle of June 2022 from malicious actors. The worker called the number, and as a result, they visited the fraudulent website myhelpcare[.]online.
  • There was two-way traffic between an FCEB network and myhelpcare[.]cc in the middle of September 2022.
Help deskthemed phishing email

Reports say an executable is downloaded when a recipient visits a first-stage malicious domain. The executable then establishes a connection to a malicious domain that is in the “second stage,” from which it downloads further RMM software.

“The actors did not install downloaded RMM clients on the compromised host. Instead, the actors downloaded AnyDesk and ScreenConnect as self-contained, portable executables configured to connect to the actor’s RMM server”, CISA noted.

In this case, the actors utilized the RMM software to start a refund scam after downloading it. They initially established a connection with the victim’s system, then lured the victim into logging into their bank account while still connected to the system. 

The recipient’s bank account summary was later changed by the actors using their access provided by the RMM software.

According to the reports, the falsely modified bank account summary showed the recipient was mistakenly refunded an excess amount of money. The actors then instructed the recipient to “refund” this excess amount to the scam operator.

Network Defenders Should Be Aware Of The Following:

  • Threat actors can maliciously use any legitimate RMM software, even though the cybercriminal actors in this campaign employed ScreenConnect and AnyDesk.
  • Threat actors can avoid both the need for administrative privileges and the software management control policies by downloading valid RMM applications as self-contained, portable executables.
  • Antivirus and antimalware protections are typically not triggered using RMM software.
  • The use of genuine RMM and remote desktop software as backdoors for persistence and C2 by malicious cyber actors is well-known.
  • RMM software enables cybercriminals to avoid employing their own malware.

Threat actors frequently target authorized RMM software users. Targets may include managed service providers (MSPs) and IT help desks, who frequently employ legitimate RMM software for network administration, endpoint monitoring, endpoint management, and remote host interaction for IT support tasks.

Hence, these threat actors can exploit trust relationships in MSP networks and gain access to a large number of the victim MSP’s customers.

Network Security Checklist – Download Free E-Book


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles