Full Report
Nothing in the attack chain screams malicious software, except none of the impersonated HR and payroll providers actually offers a desktop app
Analysis Summary
# Tool/Technique: Misuse of Remote Monitoring and Management (RMM) via Fake HR Desktop Apps
## Overview
This technique involves a social engineering campaign targeting HR and payroll professionals by offering fraudulent "desktop versions" of web-based HR platforms. The campaign utilizes legitimate AI web-builders and trusted hosting services to deliver a silent, persistent installation of **ConnectWise ScreenConnect**, a legitimate RMM tool, to gain unauthorized remote access to sensitive corporate environments.
## Technical Details
- **Type:** Technique (Living-off-the-Land / Social Engineering)
- **Platform:** Windows
- **Capabilities:** Persistent remote access, silent installation, unattended remote control, credential theft potential.
- **First Seen:** Reported September 2024 (Campaign activity noted through late 2026 in narrative context).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1218 - System Binary Proxy Execution]
- [T1564 - Hide Artifacts] (Disabling ScreenConnect UI indicators)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0009 - Collection]**
- [T1213 - Data from Information Repositories] (Targeting HR/Payroll data)
## Functionality
### Core Capabilities
- **Legitimate Tool Misuse:** Uses the ScreenConnect (ConnectWise) agent to establish a reverse shell/remote desktop session.
- **Silent Installation:** Executes a "no-interface" installer that suppresses all UI elements (no system tray icons, banners, or connection balloons).
- **Persistent Access:** Configured for "unattended" mode, allowing the attacker to connect at any time without user interaction.
- **Boot Persistence:** Configures the RMM client to launch automatically upon system startup.
### Advanced Features
- **Trusted Infrastructure:** Hosts malicious payloads on **GitHub Releases** to bypass domain reputation filters.
- **AI-Generated Phishing:** Uses the **Lovable** AI app builder to create high-quality, professional-looking landing pages.
- **Bot Protection Evasion:** Uses Cloudflare/host-based bot challenges to prevent automated security scanners and scrapers from indexing the phishing site.
- **Bait-and-Switch Execution:** Installs the genuine Microsoft .NET Desktop Runtime 8.0.26 to provide a "success" message to the user while silently installing the RMM tool in the background.
## Indicators of Compromise
- **File Names:**
- `[Impersonated_HR_Provider]_Desktop_Setup.exe`
- `Microsoft .NET Desktop Runtime 8.0.26` (Used as a decoy)
- **Network Indicators:**
- `github[.]com/[account]/[repo]/releases/download/` (Payload delivery)
- `lovable[.]app` (Site builder origin)
- `screenconnect[.]com` (Legitimate RMM traffic, though often directed to attacker-controlled instances)
- **Behavioral Indicators:**
- Presence of ScreenConnect (`ScreenConnect.Client.exe`) on HR/Payroll workstations.
- New startup entries for RMM software not authorized by corporate IT.
- Outbound connections to known RMM relay servers from non-IT departments.
## Associated Threat Actors
- **Unknown:** The specific threat actor has not been named, but the TTPs align with financially motivated groups (e.g., Business Email Compromise or Ransomware affiliates) seeking sensitive PII and payroll data.
## Detection Methods
- **Behavioral detection:** Monitor for the execution of RMM installers with silent command-line arguments (e.g., `/s`, `/quiet`, or ScreenConnect-specific silent flags).
- **Inventory Auditing:** Regularly audit installed software on sensitive workstations for unauthorized remote access tools.
- **Network Monitoring:** Alert on outbound RMM traffic originating from HR and Finance subnets.
- **GitHub Monitoring:** Scan for downloads from GitHub Releases within the corporate network that do not align with known developer workflows.
## Mitigation Strategies
- **Application Whitelisting:** Implement policies (e.g., AppLocker or Windows Defender Application Control) to block unauthorized RMM software.
- **Security Awareness Training:** Educate HR and Payroll staff that vendors typically do not offer desktop versions of web-based SaaS platforms.
- **Least Privilege:** Prevent non-administrative users from installing software or drivers.
- **Supply Chain Validation:** Verify the authenticity of software installers via digital signatures.
## Related Tools/Techniques
- **AnyDesk/TeamViewer Misuse:** Similar techniques involving the deployment of legitimate remote support tools for malicious purposes.
- **Living-off-the-Land (LotL):** The use of legitimate binaries (Microsoft .NET Installer) to mask malicious activity.