Goodbye loaders, hello RMM: the rise of legit software in ecrime campaigns

Goodbye loaders, hello RMM: the rise of legit software in ecrime campaigns

Speakers: Selena Larson (Staff Threat Researcher, Proofpoint), Ole Villadsen (Staff Threat Researcher, Proofpoint)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=cwY3uUdYzv8

Overview

In a significant shift observed since mid-2024, cybercrime campaigns are increasingly leveraging legitimate Remote Monitoring and Management (RMM) software as a first-stage payload, directly delivered via email. This talk by Proofpoint researchers Selena Larson and Ole Villadsen delves into this evolving threat landscape, highlighting how threat actors are moving away from traditional malware loaders like Qbot and Emotet. The presentation unpacks the motivations behind this pivot, the specific RMM tools being abused, and the intricate ecosystem supporting these new attack methodologies.

Historically, RMM tools were typically deployed as post-exploitation payloads or as part of Telephone-Oriented Attack Delivery (TOAD) campaigns, requiring prior victim engagement or system compromise. However, Proofpoint's telemetry now reveals a distinct trend of RMMs being the initial point of access, bypassing earlier stages of malware delivery. This change presents unique challenges for defenders, as these legitimate applications can easily masquerade as sanctioned network traffic, making detection and attribution more complex.

The research presented offers a comprehensive look at the tactics, techniques, and procedures (TTPs) employed by e-crime actors, including the lures used in email campaigns, the infrastructure supporting payload delivery, and the observed post-compromise activities. By detailing the rapid adoption and experimentation with various RMM platforms, Larson and Villadsen provide crucial insights into a burgeoning threat that demands a re-evaluation of current defensive strategies, emphasizing the need for defense-in-depth and proactive engagement with RMM providers.

Background

▶ Watch: Introduction: RMMs abused as remote access Trojans (0:00)

For years, initial access brokers (IABs) and other cybercriminals relied heavily on sophisticated malware loaders and botnets such as Qbot, Emotet, and IcedID. These high-volume campaigns consistently delivered payloads that served as the initial foothold for subsequent malicious activities, including ransomware deployment. However, the threat landscape has undergone a profound transformation, primarily driven by two key factors: aggressive law enforcement disruptions and significant improvements in defensive capabilities.

Major law enforcement operations, such as the takedowns targeting Qbot and Emotet infrastructure, imposed substantial costs on adversaries, forcing them to adapt or cease operations. Simultaneously, security vendors and organizations have enhanced their detection and defense mechanisms against these well-known loaders, making them less effective as first-stage payloads. This convergence has led to a dramatic decrease in the prevalence of these traditional malware families in email-based attacks.

In response, threat actors have pivoted their TTPs. While some have shifted focus to exploiting identity through information stealers and credential phishing, a growing number have embraced legitimate RMM software. These tools, designed for legitimate IT administration, offer several advantages to attackers: they are readily available for purchase or free trial, can be easily registered, and their network traffic blends seamlessly with legitimate enterprise operations, thereby evading traditional malware detection systems. This shift transforms a benign administrative tool into a potent weapon, acting as a Remote Access Trojan (RAT) that facilitates reconnaissance, data exfiltration, lateral movement, and the ultimate deployment of more destructive payloads like ransomware.

Key Findings

▶ Watch: Why the shift? Law enforcement & improved loader defenses (4:00)

The central finding of this research is a profound and rapid shift in e-crime tactics: the widespread adoption of legitimate Remote Monitoring and Management (RMM) software as a primary, first-stage payload in email-based campaigns. This represents a stark departure from the historical use of RMMs as secondary payloads or in specific social engineering contexts like callback phishing.

Key findings include:

• Dramatic Increase in RMM Campaigns: Proofpoint telemetry shows a massive surge in RMM delivery, with over 120 RMM campaigns observed in July and August 2024 alone. This contrasts sharply with sporadic past observations, which were typically limited to specific RMMs like NetSupport and often from initial access brokers.
• Correlation with Loader Decline: The spike in RMM activity directly aligns with a significant decrease in the delivery of traditional malware loaders (e.g., Qbot, Emotet, IcedID). This decline is attributed to successful law enforcement disruptions and improved defensive capabilities against these established threats.
• Diverse RMM Portfolio: Threat actors are experimenting with and rapidly cycling through a variety of RMM tools. While NetSupport was historically common, ScreenConnect saw an explosion in popularity in summer 2024. Following ConnectWise's certificate revocations for ScreenConnect in June/July 2024, actors pivoted rapidly to alternatives like Atera, PDQ Connect, and SimpleHelp, with PDQ Connect becoming highly favored by August 2024. Other observed RMMs include Data, BlueTrait, FleetDeck, LogMeIn, Synchro, SuperOps, and Tactical RMM.
• Legitimacy as a Weapon: The appeal of RMMs lies in their legitimate nature. They can be purchased or acquired easily, their usage can blend with normal network traffic, and they are less likely to trigger immediate security alerts compared to known malicious binaries.
• Evolving Ecosystem: The research points to a sophisticated underground ecosystem where threat actors buy, sell, trade, and share artifacts like email templates, landing pages, and even access to RMM infrastructure. This collaborative environment makes attribution more challenging and allows for rapid adaptation to defensive measures.
• Targeting Broad Spectrum: Campaigns target both consumers (e.g., via cable company email addresses) and enterprises, often leveraging Account Takeover (ATO) Jumping (or daisy-chaining) from compromised accounts to spread malicious links to known contacts, increasing click rates.

Technical Deep Dive

▶ Watch: Vendor impact: Screen Connect certificate revocation (7:00)

The shift to RMM as a first-stage payload involves a sophisticated combination of social engineering, diverse delivery mechanisms, and a flexible post-exploitation strategy. The core of the attack chain begins with email, which Proofpoint's visibility confirms as the primary initial access vector.

Threat actors craft compelling lures designed to elicit user interaction. The most prolific observed lure is related to "US social security," often seen in high-volume campaigns. Other effective themes include tax-related notices (e.g., Thompson Reuters), party invitations, Zoom or Teams meeting invites, and shared document notifications. These lures often capitalize on urgency or social curiosity, prompting recipients to click.

Delivery of the RMM typically occurs via URLs embedded directly in the email or within attachments that contain URLs. These URLs often lead to the direct download of an executable file, which, when run, installs the RMM software. To enhance credibility and bypass basic filters, attackers utilize a range of sending infrastructure. This includes newly registered domains, compromised email accounts (a highly effective tactic due to the sender's apparent legitimacy), and even legitimate marketing and survey platforms like SendGrid, QuestionPro, and Mailjet, which allow for large-scale, automated distribution.

The targeting strategy is often indiscriminate, but notable patterns include attacks against cable company email addresses (e.g., .net domains), which often serve as consumer accounts that may forward to corporate or educational inboxes, thus broadening the attack surface. A particularly insidious technique is Account Takeover (ATO) Jumping, also referred to as "daisy-chaining." In this scenario, once an initial machine is compromised with an RMM, the actor accesses the victim's email account and address book. They then leverage this compromised account to send out similar malicious emails to all contacts, exploiting trust and familiarity to propagate the RMM further.

For infrastructure, attackers employ various methods to host and deliver their payloads. Common practices include the use of publicly available URL shortener services to obfuscate the final destination. A significant observation is the frequent use of Canva URLs for hosting, a tactic so prevalent that Proofpoint refers to these actors as the "Canva crew." Additionally, Cloudflare R2.dev URLs are often used for hosting the final RMM payloads.

Upon successful execution, the RMM software grants the attacker remote control over the compromised system. The post-exploitation phase often involves downloading additional RMMs or other malicious tools. For example, Proofpoint has observed initial PDQ Connect installations being used to download and install ScreenConnect (even those with revoked certificates, albeit with limited effectiveness). Another common chain involves ScreenConnect leading to the deployment of AsyncRAT. Beyond RMMs, attackers are keen on credential harvesting, as evidenced by the download of tools like the GitHub repository-hosted Browser Credential Extractor for Windows.

The research also highlights a sophisticated ecosystem facilitating these campaigns. This ecosystem is characterized by the sharing and trading of attack artifacts among different threat clusters. Evidence includes overlaps in ScreenConnect C2 (Command and Control) domain patterns (e.g., all subdomains starting with "relay" or utilizing specific anonDNS services) prior to the certificate revocations, suggesting common infrastructure providers or sellers. Identical email templates are observed across otherwise disparate campaigns, indicating their purchase or acquisition from shared criminal forums or marketplaces. Similarly, common landing pages, such as the "phone link landing page" that instructs victims to install a non-existent "phone link app" while the RMM is installing, are reused. Interestingly, these landing pages sometimes specify a file name different from the actual downloaded executable, implying they are generic templates acquired from the ecosystem rather than custom-made.

A specific activity cluster, dubbed "BlueFleet," illustrates this ecosystem's complexity. Active since Fall 2024, BlueFleet primarily delivers BlueTrait and FleetDeck RMMs. Their campaigns employ international lures in French, English, and Spanish, focusing on payment themes and the travel industry. They often embed URLs in PDFs, sometimes explicitly mentioning the RMM name (e.g., "Fleet Deck version of Adobe"). BlueFleet has also been observed delivering Synchro and SuperOps, and subsequently downloading other RMMs like ScreenConnect, Synchro, and Tactical RMM, showcasing the dynamic and interconnected nature of these operations. This intricate web of shared resources and evolving TTPs significantly complicates traditional attribution efforts, making it harder to link specific campaigns to individual actors.

Demo / Proof of Concept

▶ Watch: Analysis of the RMM threat actor ecosystem (18:00)

The talk primarily focused on presenting telemetry data, observed campaign patterns, and analysis of threat actor TTPs rather than a live demonstration or a technical proof-of-concept walkthrough. The speakers illustrated their findings with concrete examples of email lures, landing pages, and criminal forum advertisements, effectively showcasing the real-world impact and mechanics of these RMM-centric attacks as observed in Proofpoint's data.

Defensive Implications

▶ Watch: Detection and defense strategies for rogue RMMs (23:30)

The rise of legitimate RMM software as a first-stage payload presents significant challenges for organizational defense, primarily because these tools do not inherently flag as malicious. A defense-in-depth strategy is paramount, requiring visibility across the entire attack chain rather than focusing solely on the final payload.

Defenders should implement the following measures:

1. Restrict RMM Usage to Approved Applications and Domains: This is arguably the most critical step. Organizations must establish strict policies to blocklist all unapproved RMM applications and associated domains. While legitimate RMMs are essential for IT operations, their use should be limited to specific, approved instances. This helps to immediately identify and prevent rogue RMM installations from establishing a foothold.
2. Enhance Email Security and User Education: Given that email is the primary initial access vector, robust email security solutions are crucial for detecting and blocking malicious URLs and attachments. Furthermore, continuous user education is vital to help employees recognize and report suspicious email lures, especially those exploiting social engineering tactics like "social security," "shared documents," or "party invitations." Emphasize the dangers of opening unexpected attachments or clicking unfamiliar links, even if they appear to come from known contacts (due to ATO jumping).
3. Augment Security Solutions for Full Attack Chain Visibility: Organizations need security solutions capable of monitoring the entire attack chain. This includes:

• Email Contextualization: Understanding the origin and content of the initial email.
• User Action Monitoring: Detecting suspicious downloads of executables, especially large archives that might be used for sandbox evasion.
• Endpoint Detection and Response (EDR): Monitoring RMM installation processes and subsequent activities (e.g., downloading other RMMs, credential extractors, or further payloads).
• Network Traffic Analysis: Detecting unusual RMM traffic, particularly to unapproved domains or from unexpected sources.

1. Leverage Threat Intelligence and Emerging Threats Signatures: Security teams should integrate threat intelligence feeds that track the latest RMMs being abused by cybercriminals. Resources like Emerging Threats (ET) provide maintained signatures for network traffic from legitimate RMM tools. However, it's crucial to contextualize these detections; an alert for Atera or PDQ Connect might be legitimate traffic in one environment but a malicious installation in another. Security analysts must investigate the full context (initial access, download source, user action) before dismissing a detection as a false positive.
2. Engage with RMM Providers: Organizations should actively pressure RMM vendors to implement stronger security measures to prevent abuse. The example of ConnectWise revoking ScreenConnect certificates demonstrates that vendor action can significantly disrupt threat actor TTPs and impose costs on adversaries, forcing them to pivot. Collaboration between security researchers, customers, and vendors is essential to identify and crack down on the exploitation of these legitimate tools.
3. Proactive Threat Hunting: Security teams should proactively hunt for indicators of compromise (IOCs) related to RMM abuse, including unexpected RMM installations, connections to unusual RMM C2 domains, or the presence of known post-exploitation tools like "Browser Credential Extractor."

By implementing these comprehensive defensive strategies, organizations can significantly reduce their susceptibility to RMM-based attacks and enhance their ability to detect and respond effectively to this evolving threat.

Key Takeaways

• RMMs are the New Loaders: Cybercriminals have largely abandoned traditional malware loaders like Qbot and Emotet, pivoting to legitimate Remote Monitoring and Management (RMM) software as the primary first-stage payload in email-based attacks.
• Legitimacy is a Weapon: The appeal of RMMs for attackers stems from their legitimate nature, allowing them to masquerade as sanctioned network traffic and bypass traditional malware detection, making them harder to detect and attribute.
• Dynamic Tooling and Rapid Pivoting: Threat actors are highly agile, constantly experimenting with and switching between various RMM tools (e.g., ScreenConnect, Atera, PDQ Connect, SimpleHelp) in response to defensive measures or vendor actions, as demonstrated by the rapid shift after ScreenConnect certificate revocations.
• Sophisticated Ecosystem Fuels Attacks: A complex underground ecosystem facilitates these campaigns, involving the buying, selling, and sharing of email templates, landing pages, and infrastructure, which complicates attribution and accelerates the adoption of new TTPs.
• Defense-in-Depth is Essential: Effective defense requires a holistic, defense-in-depth approach, focusing on full attack chain visibility from email lures and user actions to RMM installation and subsequent post-exploitation activity, rather than just the final payload.
• Proactive Restrictions and Vendor Engagement: Organizations must restrict RMM usage to only approved applications and domains, and actively engage with RMM providers to push for security enhancements that prevent the abuse of their legitimate software by cybercriminals.

About the Speaker(s)

Selena Larson is a Staff Threat Researcher at Proofpoint. Her work focuses on tracking cyber criminals, including those involved in fraud, initial access brokerage, and ransomware. She brings a deep understanding of the evolving e-crime landscape, particularly in how threat actors adapt their tactics, techniques, and procedures (TTPs) in response to law enforcement disruptions and improved defensive capabilities. Her personal experiences with RMM-based targeting further underscore the real-world impact of these threats.

Ole Villadsen (referred to as Ula Villit in the transcript) is also a Staff Threat Researcher at Proofpoint, specializing in cybercrime and e-crime activity, with a particular focus on RMM abuse. Ole's research provides on-the-ground insights into daily campaign activity, including the specific lures, sending methods, and targeting patterns observed in email traffic. His expertise helps illuminate the intricate details of how these RMM campaigns are executed and sustained within the broader cybercriminal ecosystem.