Dual-RMM Phishing And PowerShell RAT Campaign Hits SLTTs

CIS CTI identified an active phishing campaign targeting U.S. SLTT networks with a custom PowerShell WebSocket RAT that leads to persistent dual-RMM access through ScreenConnect and Pulseway. The operation uses Google Drive lures, Google Cloud Storage infrastructure, and continuously updated delivery variants that align with the cargo theft and freight fraud campaign previously documented by Proofpoint Threat Research. #PowerShellWebSocketRAT #ScreenConnect #Pulseway #ProofpointThreatResearch #MSISAC #GCS

Keypoints

Active phishing emails are being sent to U.S. State, Local, Tribal, and Territorial (SLTT) government networks.
The initial payload is a custom PowerShell WebSocket RAT delivered through a multi-stage phishing chain.
The campaign installs two remote monitoring and management tools, ScreenConnect and Pulseway, to maintain persistent access.
CIS CTI believes the activity is almost certainly a variant of the cargo theft and freight fraud operation previously reported by Proofpoint Threat Research.
The attackers abuse Google Drive share notifications and host lure pages and payloads on Google Cloud Storage to evade detection.
Four observed variants show active development, including encrypted C2, UAC bypass, and randomized payload builds.
Multiple U.S. SLTT member networks have already shown C2 beaconing to confirmed campaign infrastructure.

MITRE Techniques

[T1566.002 ] Phishing: Spearphishing Link – Victims receive Google Drive share notification emails that lead to malicious lure pages (‘the phishing emails are delivered as Google Drive share notifications’).
[T1036 ] Masquerading – The lure impersonates a law firm, DocuSign, and Telegram-related paths to hide malicious activity (‘fake DocuSign PDF’, ‘TelegramTabOpener’).
[T1027 ] Obfuscated Files or Information – The droppers and payloads use Base64, XOR, and other obfuscation to hide content (’embedded Base64 PowerShell RAT’, ‘XOR and Base64-encoded loader’).
[T1105 ] Ingress Tool Transfer – The lure page and VBS downloader fetch RAT content and installers from cloud storage (‘fetches the PowerShell RAT live from a separate GCS staging bucket’).
[T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell is used to execute the RAT, stage payloads, and run commands (‘invoke powershell.exe with a UTF-16LE Base64 encoded command’).
[T1059.005 ] Command and Scripting Interpreter: Visual Basic – VBS droppers assemble and launch the payload chain (‘a three-line wrapper’).
[T1059.007 ] Command and Scripting Interpreter: JavaScript – JavaScript on the lure page dynamically assembles and delivers the malicious dropper (‘JavaScript on the lure page fetches the PowerShell RAT live’).
[T1053.005 ] Scheduled Task/Job: Scheduled Task – Persistence is established with a scheduled task that runs at startup and logon (‘scheduled task named TabOpenerAgent’).
[T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – A registry Run key is used as fallback persistence (‘a registry Run key named GoogleChromeAutoStart’).
[T1218.005 ] System Binary Proxy Execution: Msiexec – The attackers silently install RMM software using msiexec (‘installed via msiexec /quiet /qn’).
[T1090.001 ] Proxy: Internal Proxy – The WebSocket RAT and RMM tools provide remote access channels that relay operator interaction (‘full-duplex channel for real-time, hands-on-keyboard interaction’).
[T1204.002 ] User Execution: Malicious File – The phishing chain relies on user clicks to open the Google Drive lure and download the dropper (‘Once a victim clicks the Google Drive link’).
[T1219 ] Remote Access Software – ScreenConnect and Pulseway are installed for persistent remote access (‘dual-RMM deployment’, ‘Both RMMs establish independent, persistent remote access channels’).
[T1112 ] Modify Registry – The registry Run key is written to maintain access (‘a registry Run key named GoogleChromeAutoStart’).
[T1140 ] Deobfuscate/Decode Files or Information – The payload is decoded from Base64 and deobfuscated before execution (‘Once decoded, the initial PowerShell writes…’).

Indicators of Compromise

[IP addresses ] WebSocket RAT C2 and related infrastructure – 45.61.163[.]253:3000, 172.86.108[.]91:3000
[Domains ] C2, lure, and phishing infrastructure – 360securityaccess[.]com, mgnajgk2.anondns[.]net, thehealingpc.pulseway.com, safeandtrustedconnections[.]com, instantotification[.]com
[URLs / Paths ] Malicious WebSocket endpoint and cloud storage hosting – wss://360securityaccess[.]com, Google Cloud Storage staging buckets
[File names ] Droppers and installer payloads – mg.msi, windows_agent_x64.msi, agent.ps1
[Registry / task names ] Persistence artifacts – TabOpenerAgent, GoogleChromeAutoStart
[File hash ] Exact Pulseway installer match with prior campaign – SHA256 hash match for the Pulseway installer (one exact match noted, plus multiple overlapping samples)

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print

Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs