We have just posted our latest research with our observations and analysis into ConnectWise ScreenConnect attacks.

We’ve observed multiple attacks in the past 48 hours. This has included a malware that was built using the LockBit 3 ransomware builder tool leaked in 2022: this may not have originated with the actual LockBit developers.

But we’re also seeing RATS, infostealers, password stealers and other ransomware. All of this shows that many different attackers are targeting ScreenConnect.

Anyone using ScreenConnect should take steps to immediately isolate vulnerable servers and clients, patch them and check for any signs of compromise.

We have extensive guidance and threat hunting material from our teams to help.

We’ll provide updates to our blog with more information as appropriate.

#Sophosxops #threatintel

https://news.sophos.com/en-us/2024/02/23/connectwise-screenconnect-attacks-deliver-malware/

​Would you catch this as an malicious ad?
1️⃣​ Google ad spoofing "dropbox.com"
2️⃣​ Click & redirection involving l.hyros[.]com -> drcpbox[.]net
3️⃣ Fake Dropbox Download "Dropbox-x64.msix"
4️⃣ Powershell execution of #LummaStealer

This campaign is also targeting:
🎯 Zoom (windows only)
🎯 Streamlabs (windows only)
🎯 Telegram (windows & mac)
🎯 TradingView (windows & mac)
🎯 Basecamp (windows only)

#IOCs:
🔗​https://www.virustotal.com/gui/file/60acae4c1ab23e506468ae1995868e8f76f9e7f25439fb154f987ea2e2a9b9cd
🔗​ https://virustotal.com/gui/file/264b1e91bdc38110ee707a4fb7e772433d7a6a17c2ab2d552eb5c4abbe450147

It's copycat season with fake updates. (This was reported earlier).

Loaded via: itsdigitalshiva[.]com/cdn-js/wds.min.php

Payload is again NetSupport RAT after malicious JS execution.

Added regexes for detection in EKfiddle and calling it SmartApeSG (after the hosting company name).

#SocGholish

In mid-June, Sophos identified a previously unnoted initial-access campaign targeting IT users via malicious advertising (malvertising) – one that uses interesting export forwarding and DLL pre-loading techniques to mask malicious activity, hinder analysis, and generally support its foothold once on the target network. Our colleagues at Trend are watching this adversary too, and have some thoughts on what we’re tracking as “Nitrogen,” after we observed a string in the PDB path commonly used among the samples. As we continue our own research, we are sharing early findings with the community. (1/4)

#threatintel #sophosxops