More RMM Tools In the Wild, (Tue, Oct 6th)
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one. Same scenario, it started with a phishing email that delivers a fake PDF invoice to the victim: When the PDF is opened, it just redirect to a malicious VBS file. Indeed, the PDF contains an “OpenAction” and “URI” keywords, that sounds weird! remnux@remnux:~…
Action1 US