A single developer-known online as RockyBelling has assembled a highly modular PhaaS/MaaS ecosystem that affiliates worldwide use to launch highly targeted IRS and SSA-themed phishing campaigns that predominantly hit U.S. victims.
SOCRadar research spanning April 2025–April 2026 ties almost 200 affiliates to a commercial toolkit that combines sophisticated cloaking, flexible payload options, real-time victim telemetry via Telegram, and self-hosted remote management panels to convert credential theft into persistent access.
At the core is a sold-and-supported product suite: phishing kits with built-in Adspect cloaking, a mass-mailer (Rocky Gmail Sender), credential harvesting panels, post-exploitation PowerShell scripts, and self-hosted ScreenConnect RMM panels provisioned per affiliate.
RockyBelling operates a Telegram channel Rocky War Room that functions as a storefront, support desk, and announcement feed.
Code and repository artifacts linked to his GitLab account, together with embedded Telegram bot tokens and matched infrastructure fingerprints, support attribution to a single developer who maintains and updates the service, including the April 2026 release of a Visual Basic Script (VBS) dropper with a UAC bypass.
The operation’s success depends on layered filtering and real-world targeting. Initial checks block non-Windows User-Agents and return benign pages to likely crawlers.
Cloaking via Adspect fingerprints visitors (WebGL, timezone, touch events, other telemetry) and only serves the phishing page to profiles that match human, Windows-based victims. URL-fragment randomization and per-visit download directories frustrate automated analysis and static blocklisting.
RockyBelling – also known as Rock, Rockky, and Mike runs a Telegram channel called Rocky War Room, which had 194 subscribers at the time of analysis and functions as a product catalog, announcement channel, and support desk for his criminal services.
When a victim reaches the lure a convincingly rendered IRS, Social Security, or trusted SaaS portal the flow subtly coaxes them to download a “Security Connector,” normalizing execution of the delivered installer.
SOCRadar’s Threat has named this cybercrime ecosystem The Quarry, and it has been running since at least April 2025. Payload delivery favors legitimate RMM software: affiliates typically receive a ScreenConnect MSI or EXE that installs silently and provides interactive remote access.
Across the research window analysts identified over 40 distinct ScreenConnect panels hosting customized installers and more than 80 campaign domains.
Telegram functions as the lightweight C2/telemetry backbone: victim download events, IPs, user agents, timestamps, and direct download links are posted to affiliate bots in real time.
PHP files with randomly generated 10-character names referenced by the index file run a browser fingerprinting routine using Adspect, a traffic filtering service used here as a cloaking layer.
This mobile-first monitoring model means operators can triage victims and act quickly without persistent desktop infrastructure.
In April 2026 Rocky introduced a VBS dropper that bypasses the web delivery phases entirely.
The obfuscated script requests elevated privileges via a UAC prompt, downloads a decoy PDF alongside a ScreenConnect MSI hosted on GitHub/GitLab, installs the RMM silently (/quiet ALLUSERS=2), opens the decoy to maintain plausibility, and self-cleans to remove forensic traces.
This alternate path reduces operator reliance on phishing domains and increases success where recipients open attachments.
Post-exploitation tooling is specialized for U.S. tax fraud: PowerShell scripts extract six months of browser history and perform recursive searches for W-2 files, exfiltrating results to Telegram.
The remaining percentage likely includes US-based employees working remotely from other countries, individuals abroad with US tax obligations, and users behind VPN services. Countries where non-US victims were recorded include Egypt, Brazil, Germany, Japan, and Canada.
Logs recovered from monitored bots also show AWS credentials and other corporate secrets being harvested. The criminal ecosystem supports resale: evidence points to Initial Access Broker activity and potential downstream sale of credentials or access to ransomware groups.
Detection and mitigation require defenders to focus on the operation’s technical signatures: Adspect stream_id reuse across domains, characteristic PHP filenames (de.php, docs.php), unique payload naming conventions, Telegram bot tokens embedded in webserver code, and the ScreenConnect JARM fingerprint.
Organizations should prioritize blocking known malicious domain clusters, monitoring outgoing connections to suspicious ScreenConnect panels, restricting or logging use of Telegram API calls from enterprise networks, and enforcing email attachment and macro/Script handling policies.
The Quarry demonstrates how a single, well-supported criminal product can scale affiliate operations while evading many traditional detection mechanisms by blending commodity remote management tools, effective cloaking, and mobile-first C2.
Public and private sector defenders must treat these campaigns as a unified service-driven threat and hunt for the operation’s reusable artifacts rather than isolated phishing incidents.
Domains
estatetaxarchives.com
hub.ssa-guidance.com
inherittaxpapers.site
verify.federal-docviewer.com
portal.federalverify-ssaclientportal.com
trusttaxportal.com
estatetaxrecords.com
tax-filecenter-irs.matthewtarwater.com
apps.docu-sign.net
secure.login-socialsecurity.com
hub.ssa-userstatus.com
secure.ssa-documentsync.com
MD5 hashes
8974830446d35e234881696092aded87
ef970697c5094c443f0456774cfee9bc
935413b08ef60cd819b2e1b573fc9050
2163afa18a3cdfa525b767e0e1baaba1
1827aa636cd86d1a4064e112aa197303
00b69eb7f44b5987f68667343aaafb6a
01ab231bcd9533f90e99651521b6e1bb
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…