More RMM Tools In the Wild, (Tue, Oct 6th)
Attackers phish victims with a fake PDF that installs Action1’s signed RMM agent for persistence.
SANS ISC handler Xavier Mertens analyzed a phishing email carrying a fake PDF invoice. The PDF OpenAction URI fetched an unobfuscated VBS script that displayed a decoy invoice and downloaded action1.msi. The installer deploys Action1 Corporation-signed binaries as the A1Agent Windows service, storing keys under HKLM\Software\Action1\Agent and connecting to server.na-2.action1.com with customer ID 49b18106-681d-456a-b098-092e2818c09a. The signing certificate expired in May 2026, and VirusTotal did not flag the four bundled files.
- Phishing PDF OpenAction fetches an unobfuscated VBS from Vercel.
- VBS shows a decoy invoice and installs action1.msi.
- Signed Action1 binaries run as the A1Agent Windows service.
- Agent beacons to na-2.action1.com using a customer ID.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1059.005 Visual BasicT1219 Remote Access SoftwareT1543.003 Windows Service
- Vendors
- Action1
- Products
- Action1 Agent
- Organizations
- SANS Internet Storm CenterAction1
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | action1.com | connecting to the Action1 infrastructure via server[.]na-2.action1[.]com. We are facing here the same behaviour: the threat actor |
| domain | server.na | 818c09a and is connecting to the Action1 infrastructure via server[.]na-2.action1[.]com. We are facing here the same behaviour: t |
| sha256 | 1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4caf0217c679f9f3b20342 | 0721a141b178a9c372b6e878012180ec9e9d4e7bd06 a1_sas_dll_file 1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4caf0217c679f9f3b20342 action1_remote_exe 941695d20d82dd5d62f74b0111feb23720637202 |
| sha256 | 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3 | 2c643648cfc70a385f4caf0217c679f9f3b20342 action1_remote_exe 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3 main_service_exe These files belongs to the RMM tool develo |
| sha256 | 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06 | 71e70082740dbfeee5dd846829d541f588ad43378727 a1_7z_dll_file 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06 a1_sas_dll_file 1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4 |
| sha256 | eaff35d250c9b04f51c971e70082740dbfeee5dd846829d541f588ad43378727 | les that are not reported as malicious by VT: $ sha256sum * eaff35d250c9b04f51c971e70082740dbfeee5dd846829d541f588ad43378727 a1_7z_dll_file 996b01e15f85e165899630721a141b178a9c372b6e87 |
| url | https://up-theta-rose.vercel.app/action1.msi | n parallel, a MSI archive will be downloaded and installed: hxxps://up-theta-rose.vercel[.]app/action1.msi The MSI file contains 4 files that are not reported as ma |
| url | https://up-theta-rose.vercel.app/adobe_new_update.vbs | 27 71.3010032362460606] /Border [0 0 0] /A << /S /URI /URI (hxxps://up-theta-rose.vercel[.]app/adobe_new_update.vbs) >> >> ] /Contents 4 0 R >> The URL will be visited thank |
From the original article
2 min read at isc.sans.edu
It seems that a trend started… I continue my journey discovering more RMM ("Remote Management & Monitoring") tools abused by threat actors! A few days ago, I wrote a diary[1] about ScreenConnect used in the wild. Today, I found another one.
isc.sans.edu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.