Full Report
The Huntress SOC uncovered phishing attacks that trick employees into installing rogue RMM tools like ScreenConnect for persistent access. Learn how to spot it.
Analysis Summary
# Tool/Technique: Rogue RMM Abuse (ScreenConnect / ITarian)
## Overview
This technique involves the unauthorized installation of legitimate Remote Monitoring and Management (RMM) tools via phishing lures. Instead of using custom malware, attackers weaponize trusted software (like ConnectWise ScreenConnect and ITarian) to gain persistent, hands-on access to a victim's environment. The primary goal is to bypass security controls that may flag unknown binaries while establishing redundant "backdoor" access through legitimate vendor infrastructure.
## Technical Details
- **Type:** Technique / Tool Abuse
- **Platform:** Windows (primarily targeted in these cases)
- **Capabilities:** Remote desktop access, file transfer, command execution, and long-term persistence.
- **First Seen:** September 2024 (Huntress reported activity)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- **[TA0003 - Persistence]**
- [T1219 - Remote Access Software]
- **[TA0005 - Defense Evasion]**
- [T1202 - Indirect Command Execution]
- [T1036 - Masquerading] (Abusing trusted software signatures)
## Functionality
### Core Capabilities
- **Persistent Access:** Once installed, these tools remain as services or background processes, allowing attackers to reconnect at any time without further user interaction.
- **Live Interaction:** Attackers gain a full GUI or shell experience to navigate the system, similar to a legitimate IT support session.
- **Redundancy (Stacking):** Attackers frequently install multiple RMM clients (e.g., ITarian followed by ScreenConnect) so that if one is detected and removed, a secondary path remains active.
### Advanced Features
- **Trusted Communication:** Traffic is directed to legitimate domains (e.g., `*.screenconnect.com`), which often bypasses traditional firewall and DNS filtering rules.
- **Automated Deployment:** Lures are designed to trigger the installer under the guise of "opening a document" or "joining a support session."
## Indicators of Compromise
- **File Names:**
- `ScreenConnect.ClientSetup.msi`
- `ITarian_Agent_Installer.exe`
- Document lures mimicking invoices, secure messages, or HR documents.
- **Network Indicators:**
- `instance-h6k2j1-relay.screenconnect[.]com` (Example format - defanged)
- `*.itarian[.]com` (Defanged)
- `*.screenconnect[.]com` (Defanged)
- **Behavioral Indicators:**
- Unexpected installation of RMM software in environments where that specific vendor is not used.
- RMM processes (e.g., `ScreenConnect.Client.exe`) running under a standard user context rather than a system-wide deployment.
- New service registrations for "ITarian" or "ConnectWise."
## Associated Threat Actors
- While specific group names were not attributed in the article, this technique is a hallmark of **Initial Access Brokers (IABs)** and **Ransomware Affiliates** who prefer "living off the land" (LotL) using legitimate tools.
## Detection Methods
- **Behavioral Detection:** Monitor for `msiexec.exe` or `powershell.exe` spawning from web browsers or email clients to install RMM packages.
- **Inventory Benchmarking:** Audit all installed RMM agents. Any agent not associated with the organization’s official MSP or IT department should be flagged as rogue.
- **DNS/Traffic Analysis:** Alert on connections to RMM control domains that do not originate from known administrative workstations.
## Mitigation Strategies
- **Software Restriction Policies:** Implement AppLocker or Windows Defender Application Control (WDAC) to block unauthorized RMM binaries from executing.
- **User Education:** Train employees to recognize that "opening a document" should never prompt the installation of new software.
- **Least Privilege:** Prevent standard users from having local administrative rights, which restricts their ability to install persistent system services.
- **Network Segmentation:** Limit the ability of workstations to communicate with known RMM relay servers unless strictly necessary.
## Related Tools/Techniques
- **AnyDesk / TeamViewer Abuse:** Similar abuse of legitimate remote access software.
- **Living off the land (LotL):** Using built-in or trusted tools to carry out malicious objectives.
- **EDRSilencer:** Often used in tandem with rogue RMMs to hide the attacker's activity from security agents.