Hackers are deploying familiar Zoom files and PDF downloads to embed remote-control software on business computers This article explores installer distributed deceptive. .

Indicators of Compromise (IoCs) include: - SHA-256 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc Legitimate MSP360 RMM v2.5.0.67 installer distributed under deceptive filenames; the sample was signed with a revoked certificate - SHA-1 f34330d4c6e0aa978dc3af40360c14b31ad51127 MSP360 RMM installer hash observed in the campaign - SHA-256 f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97 - 857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3 - 6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e - 4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26 Legitimate MSP360 RMM Agent Service samples observed during the campaign - Domain adswre[. ]cfd - trews[. ]cfd - swedcorry[.]stefneyv[.

]com - ojsuyw[.]niyari[. ]org - bunstar[.]harej[. ]si - adsaw[. ]cfd - sdfghj[.]rd-team[.

]ru Domains contacted by ScreenConnect clients during observed malicious sessions - SHA-256 ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0 - 02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550 - 499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a - d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdc - 67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55 - 6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc - dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64 - 40f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1 - 3ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096 - 374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187 - bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6c - c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208 - 5bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b - 19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1 - d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db - d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53ef - e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3 - 1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8 - 77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a - fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2 - 06ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b - a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657 - 529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63 - ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88 - a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b Utilities transferred or executed through ScreenConnect sessions during post-compromise activity - File name VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe - ZoomSetup_Installation_v2.5.0.67_oid[redacted].exe - PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_oid[redacted].exe - RSVP_INVITATION_E_CARD_rmm_v2.5.0.67_oid[redacted].exe - SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid[redacted].exe Observed deceptive MSP360 installer filenames - File name ClientSetup.msi - WindVerify.exe - WindowsUpdate.exe - WindowsSecurity_PIN.exe - WindowsSecurity_Password.exe - WindowsPassKey.exe - SCHider.exe - PIN.exe - phonepc.exe - DefenderDT.exe - DefenderControl.exe - phonelinkupdate.exe - PhoneLinkPrompt.exe - Passwords.EXE - OpenCamera.exe - open_phone_link.exe - MouseHiderGUI.exe - HideUL.exe - HideMouseApp.dll - HideMouse.exe - HideFromControlPanel.exe - HideCursor.exe - BannerHider.exe - WebBrowserBookmarksView.exe - WebBrowserPassView.exe ScreenConnect installer and utilities observed during post-compromise activity Restrict your investigations to threat intelligence platforms like MISP, VirusTotal, or your SIEM.