US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.
A phishing campaign that tricks victims into installing legitimate remote monitoring and management (RMM) software spans 46 countries, with around 45% of observed activity targeting the United States, according to ANY.RUN. Lures include Canada Revenue Agency tax forms, UPS shipping notices, Adobe PDF pages, Social Security Administration themes and invoices, delivered through rapidly rotated Vercel, GitHub Pages and Netlify infrastructure. Researchers identified 425 kit URLs across 240 hosts, 94% of which appeared for only a single day, while stable kit indicators such as font1.woff2 and the secure.html to project/*.zip chain tie the infrastructure together.
- 601 cases tied to one campaign spanning 46 countries
- Legitimate RMM software abused to gain remote access
- Infrastructure rotated daily; 94% of 240 hosts seen once
- Education, technology and government among top targeted sectors
- Stable kit fingerprints aid detection beyond rotating domains
- Vendors
- ANY.RUN
- Organizations
- ANY.RUN
- Countries
- United StatesCanada
From the original article
2 min read at thehackernews.com
An RMM phishing campaign initially associated with Canadian targeting due to its use of Canada Revenue Agency (CRA) tax forms as lures has turned out to be part of a broader campaign spanning 46 countries. Around 45% of observed activity was associated with the United States, making it the campaign's top geographic target. ANY.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.