Full Report
See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act.
Analysis Summary
# Incident Report: Browser-in-the-Browser (BiTB) Phishing and Rogue RMM Persistence
## Executive Summary
In August 2024, Huntress detected and neutralized two linked attacks involving a Browser-in-the-Browser (BiTB) phishing technique. Victims were tricked into downloading a rogue ScreenConnect (RMM) installer under the guise of an Adobe Acrobat update, which provided the attackers with persistent remote access. The threat actors subsequently deployed defense-evasion binaries to hide their activity before the SOC intervened to terminate the compromise.
## Incident Details
- **Discovery Date:** August 2024
- **Incident Date:** August 2024
- **Affected Organization:** Not disclosed (Two distinct entities)
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** August 2024
- **Vector:** Phishing email leading to a Browser-in-the-Browser (BiTB) landing page.
- **Details:** The victim clicked a link in a phishing message and was redirected to a site using HTML/CSS/JavaScript to spoof a legitimate Adobe subdomain. A prompt to "View Files" triggered a fake browser window, tricking the user into downloading a malicious ScreenConnect installer disguised as an "Adobe Reader update."
### Lateral Movement
- **Details:** The report does not detail lateral movement, as the attack was focused on establishing a beachhead and persistence on the initial endpoints.
### Data Exfiltration/Impact
- **Details:** No data exfiltration was reported. The primary impact was the unauthorized installation of remote management software and the execution of defense-evasion tools.
### Detection & Response
- **Discovery:** Huntress SOC detected the installation of unauthorized ScreenConnect instances and the execution of suspicious binaries.
- **Response Actions:** The Huntress SOC shut down the attacks by isolating the affected endpoints and removing the rogue RMM instances before further objectives could be met.
## Attack Methodology
- **Initial Access:** Social Engineering via BiTB (Browser-in-the-Browser) phishing.
- **Persistence:** Deployment of multiple rogue ScreenConnect (ConnectWise) RMM instances.
- **Privilege Escalation:** Not specified (implied via RMM capabilities).
- **Defense Evasion:** Execution of `HideCursor.exe` and `HideUL.exe` to mask attacker activity and UI elements.
- **Credential Access:** BiTB landing page was designed to harvest interactions/trust; specific credential theft not detailed.
- **Discovery:** Potential reconnaissance performed via the ScreenConnect interface.
- **Lateral Movement:** Not observed before containment.
- **Collection:** Not observed.
- **Exfiltration:** Not observed.
- **Impact:** Unauthorized remote control and potential for follow-on ransomware or data theft.
## Impact Assessment
- **Financial:** Minimal (due to early detection).
- **Data Breach:** None reported.
- **Operational:** Low; remediation required for the infected endpoints.
- **Reputational:** Low; internal incident mitigated.
## Indicators of Compromise
- **Network indicators:**
- Traffic to unauthorized ScreenConnect instances.
- [defanged] `adobe[.]acrobat[.]com` (spoofed via BiTB).
- **File indicators:**
- `HideCursor.exe`
- `HideUL.exe`
- ScreenConnect MSI installers (unauthorized).
- **Behavioral indicators:**
- Web browser launching a setup file for remote management software.
- Unexpected deployment of RMM tools not managed by the organization's IT department.
## Response Actions
- **Containment:** Terminated rogue ScreenConnect sessions.
- **Eradication:** Uninstalled unauthorized ScreenConnect agents and deleted associated defense-evasion binaries.
- **Recovery:** Endpoint monitoring heightened for the affected users.
## Lessons Learned
- **UI Sophistication:** Threat actors are successfully using BiTB to bypass traditional "check the URL" training, as the fake address bar looks perfectly legitimate.
- **RMM Abuse:** Legitimate tools like ScreenConnect remain a primary choice for persistence due to their ability to blend in with normal administrative traffic.
- **Early Detection:** 24/7 monitoring was critical in identifying the transition from a browser-based lure to endpoint-based persistence.
## Recommendations
- **Technical Controls:** Implement Application Whitelisting/Allowlisting to prevent unauthorized RMM tools from executing.
- **Security Awareness:** Update training to include Browser-in-the-Browser (BiTB) examples; teach users that legitimate updates (like Adobe) rarely occur via a browser popup on a third-party site.
- **Web Filtering:** Ensure web security gateways are configured to block newly registered domains and known phishing infrastructure.
- **Endpoint Monitoring:** Monitor for the execution of "hidden" UI utilities or unauthorized remote access tools.