Threat Actors Leverage Several RMM Tools in Phishing Attack to Maintain Remote Access

Cybercriminals are increasingly exploiting legitimate remote monitoring and management (RMM) tools to establish persistent access to compromised systems through sophisticated phishing campaigns.

Joint research conducted by Red Canary Intelligence and Zscaler threat hunters has identified multiple malicious campaigns utilizing ITarian (also known as Comodo), PDQ, SimpleHelp, and Atera RMM solutions as attack vectors.

The appeal of RMM tools for adversaries lies in their inherent legitimacy within enterprise environments, where IT professionals routinely deploy these solutions for remote access, system monitoring, and machine management.

This veneer of authenticity allows threat actors to operate stealthily without triggering immediate security alerts, as their activities often blend seamlessly with legitimate administrative tasks.

Red Canary analysts identified four primary social engineering lures that have proven successful in convincing targets to download malicious RMM tools onto their systems.

These include fake browser updates, meeting invitations, party invitations, and fraudulent government forms.

The researchers also discovered a concerning trend where adversaries deploy two RMM tools in rapid succession, effectively establishing multiple persistent access methods to ensure continued control over compromised environments.

The campaigns demonstrate sophisticated targeting mechanisms, with threat actors specifically focusing on Windows desktop users while filtering out mobile devices.

The attack infrastructure includes command and control servers that collect browser fingerprinting data, geolocation indicators, and engagement metrics to optimize campaign effectiveness.

Advanced Infection Mechanisms and Payload Delivery

The technical sophistication of these attacks becomes evident through their multi-layered infection mechanisms.

In the fake browser update campaigns, adversaries inject malicious JavaScript into compromised websites that create full-screen overlay attacks.

The injected code uses maximum z-index values (2147483647) to ensure the fake update prompt appears above all other page elements, effectively trapping users within the malicious interface.

The JavaScript payload performs dynamic iframe creation, loading content from suspicious domains including chromus[.]icu and mypanelsuper[.]online while maintaining redundancy through multiple fallback URLs.

This approach ensures campaign continuity even when individual domains are blocked by security controls.

The malicious code also implements data exfiltration capabilities, sending browser fingerprinting data, geolocation indicators, and unique tracking hashes to command and control servers.

Once users interact with these lures, they unknowingly download legitimate RMM installers that have been weaponized through adversary-controlled tenants.

For instance, ITarian installations execute through URLs containing redacted tenant identifiers, allowing the downloaded MSI files to contact additional domains and execute secondary payloads.

The ITarian application, operating as RmmService.exe, has been observed launching malicious processes like DicomPortable.exe and establishing registry modifications for persistence.

The sophistication extends to payload deployment, where threat actors utilize techniques such as DLL sideloading through legitimate signed binaries.

In documented cases, DicomPortable.exe sideloaded malicious Qt5Core.dll using software signed by Apowersoft Ltd, subsequently deploying HijackLoader for further compromise activities.

This approach leverages code-signing trust mechanisms to bypass security controls while delivering information stealers and additional remote access tools.

Detection of these campaigns requires monitoring for RMM tools executing child processes from unusual directories, particularly when these tools are not typically authorized within the environment.

Organizations should maintain strict allowlists for legitimate RMM deployments and implement network controls to identify suspicious newly registered domains hosting these malicious campaigns.

Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.