The #SophosMDR team also discovered cases where threat actors targeting #PaperCut were abusing the bitsadmin.exe Windows application to download payloads. #BITSAdmin is commonly abused by active adversaries as a "living off the land binary" or #LOLbin, handy for accomplishing the task of downloading payloads.

The tools exploited in the attacks have included what we refer to as “dual-use agents,” used both legitimately by IT staff and maliciously by attackers. At the time of writing, Sophos has observed the abuse of #AnyDesk, #Atera, #Synchro, #TightVNC, #NetSupport, and #DWAgent remote management tools across multiple campaigns.

4/6

Post-exploitation activity targeting #PaperCut often results in #PowerShell commands being executed by the pc-app.exe parent process. We've collected logs of the affected system downloading #Atera remote monitoring software to the victim. (Atera is, of course, legitimate software, being abused by the attackers in this situation.)

Different threat groups are abusing PowerShell in different ways. One group calls PowerShell commands directly, as shown here. This particular attacker delivered a ransomware binary that was hosted on the ephemeral file host #tmpfiles (files hosted there are deleted from the server after 60 minutes):

3/6