Full Report
Huntress has uncovered a series of unauthorized access, revealing a threat actor using ScreenConnect to infiltrate multiple healthcare organizations.
Analysis Summary
# Incident Report: Unauthorized Access via Third-Party Pharmaceutical Vendor Tools
## Executive Summary
Huntress identified a series of unauthorized intrusions targeting healthcare organizations, specifically pharmacies and clinics, by exploiting a pre-existing ScreenConnect instance used by the pharmaceutical software vendor Transaction Data Systems (now Outcomes). Threat actors leveraged this initial access to deploy additional remote access tools (RATs) and execute reconnaissance commands, preparing the environment for further malicious activity such as ransomware. The timely intervention of antimalware protections and SOC monitoring disrupted the final execution of a Metasploit payload.
## Incident Details
- **Discovery Date:** Late October 2023
- **Incident Date:** August 9, 2023 – October 31, 2023
- **Affected Organization:** Multiple (clients of Transaction Data Systems/Outcomes)
- **Sector:** Healthcare / Pharmaceutical
- **Geography:** United States (Multiple locations)
## Timeline of Events
### Initial Access
- **Date/Time:** August 9, 2023
- **Vector:** Third-party vendor remote access software (ScreenConnect).
- **Details:** Attackers gained access to a legitimate ScreenConnect instance (Instance A) managed by a third-party pharmaceutical vendor on a Windows Server 2019 system.
### Lateral Movement
- **August 9 - October 28:** Attackers used the "redacted 1" account to install a secondary ScreenConnect instance (Instance B) for redundancy.
- **October 28 - October 30:** Attackers transitioned to the "redacted 2" account, using PowerShell to download and install a third instance (Instance C) from `http://2.57.149[.]103/a.msi`.
- **October 30:** A configuration file `test.xml` was downloaded via PowerShell from `http://119.91.138[.]133:443/test.xml`.
### Data Exfiltration/Impact
- **Internal Reconnaissance:** Attackers executed `nslookup` queries against OpenDNS to identify public IP information.
- **Malware Deployment:** The attackers attempted to load a Metasploit Meterpreter instance into memory using `msbuild.exe` to process the `test.xml` file.
### Detection & Response
- **Detection:** Antimalware protections flagged the `test.xml` payload execution attempt on October 31.
- **Response:** Huntress SOC analyzed the logs, identified the unauthorized ScreenConnect instances, and tracked the activity across multiple distinct endpoints in the healthcare sector.
## Attack Methodology
- **Initial Access:** Abuse of legitimate third-party vendor ScreenConnect instance.
- **Persistence:** Installation of multiple redundant ScreenConnect and AnyDesk instances.
- **Privilege Escalation:** Execution of commands via the `Printer Spooler` service (`spoolsv.exe`) and `Administrator` account profiles.
- **Defense Evasion:** Use of the `nps` project (C#) to load payloads in memory; use of `msbuild.exe` to execute XML-based code.
- **Discovery:** DNS lookups (`nslookup`) to confirm external connectivity and IP details.
- **Lateral Movement:** Transitioning between different ScreenConnect instances and user accounts.
- **Collection:** N/A (Disrupted prior to major data staging).
- **Impact:** Attempted deployment of Metasploit Meterpreter for full system control.
## Impact Assessment
- **Financial:** Unknown; potential for high costs if ransomware had been deployed.
- **Data Breach:** Preparation for breach observed; no confirmed volume of stolen data reported.
- **Operational:** Minimal disruption due to early detection, though remediation required system audits.
- **Reputational:** Risk to the third-party vendor (Transaction Data Systems) whose tools were leveraged.
## Indicators of Compromise
- **Network Indicators:**
- `2.57.149[.]103` (MSI Download)
- `45.66.230[.]146` (ScreenConnect C2)
- `119.91.138[.]133` (Payload Host)
- `myip.opendns[.]com` (Reconnaissance)
- **File Indicators:**
- `ConnectWiseControl.ClientSetup.msi`
- `a.msi`
- `test.xml` (C# wrapper for Metasploit)
- **Behavioral Indicators:**
- Unexplained `msbuild.exe` execution loading XML files from `C:\ProgramData\`.
- Multiple installations of different RMM tools (ScreenConnect, AnyDesk) on a single server.
## Response Actions
- **Containment:** Terminated unauthorized remote access sessions and isolated affected endpoints.
- **Eradication:** Removed unauthorized ScreenConnect and AnyDesk installations; deleted malicious `.msi` and `.xml` files.
- **Recovery:** Audited account logs and changed credentials for all affected administrative accounts.
## Lessons Learned
- **Supply Chain Risk:** Legitimate vendor tools can be a blind spot; even trusted software like Rx30/ComputerRx requires monitoring if it bundles remote access tools.
- **RMM Overlap:** The presence of multiple RMM tools on one endpoint is a high-fidelity indicator of malicious activity.
## Recommendations
- **Restrict RMM Usage:** Implement application blocklists for unauthorized remote access tools (AnyDesk, ScreenConnect, etc.).
- **Monitor MSBuild:** Alert on `msbuild.exe` processing files in non-standard directories like `C:\ProgramData\`.
- **Vendor Audits:** Require third-party vendors to use Multi-Factor Authentication (MFA) for their support connections into your environment.