Federal agencies hacked using legitimate remote desktop tools

[vtqhtr413]

Content source

https://www.bleepingcomputer.com/news/security/cisa-federal-agencies-hacked-using-legitimate-remote-desktop-tools/

CISA, the NSA, and MS-ISAC warned today in a joint advisory that attackers are increasingly using legitimate remote monitoring and management (RMM) software for malicious purposes. More worryingly, CISA discovered malicious activity within the networks of multiple federal civilian executive branch (FCEB) agencies using the EINSTEIN intrusion detection system after the release of a Silent Push report in mid-October 2022.This activity was linked to the "widespread, financially motivated phishing campaign" reported by Silent Push and was detected on "many other FCEB networks" after first being spotted on a single FCEB network in mid-September 2022.The attackers behind this campaign began sending help desk-themed phishing emails to federal staff's government and personal email addresses since at least mid-June 2022.

"The emails either contain a link to a 'first-stage' malicious domain or prompt the recipients to call the cybercriminals, who then try to convince the recipients to visit the first-stage malicious domain." Callback phishing attacks like the ones targeting FCEB staff in this campaign have seen a massive 625% growth since Q1 2021 and have also been adopted by ransomware gangs. These groups include ones that split from the Conti cybercrime operation, such as the Silent Ransom Group, Quantum (now Dagon Locker), and Royal.

CISA: Federal agencies hacked using legitimate remote desktop tools

CISA, the NSA, and MS-ISAC warned today in a joint advisory that attackers are increasingly using legitimate remote monitoring and management (RMM) software for malicious purposes.

www.bleepingcomputer.com

 

[Andrezj]

remote monitoring and management are used by many organizations, even internet service providers

popular ones are windows intune, connectwise and datta

hack an administrator system managing endpoints with rmm and the hacker has the keys to kingdom, this is why hackers are increasingly targeting managed service providers and managed security service providers