MSP360 Dual-RMM Phishing Delivering ConnectWise ScreenConnect

Starting in July 2026, Microsoft Defender Experts observed phishing campaigns across multiple industries that distribute a legitimate, digitally signed MSP360 Remote Monitoring and Management (RMM) installer (v2.5.0.67) under deceptive filenames themed as meeting invitations, PDF-reader updates, e-cards, job offers, document-signature requests, and government benefit statements. The attacker's objective is not to exploit software, but to get a victim to run a trusted, vendor-signed management tool voluntarily, converting a single click into full remote administration of the endpoint.

Once installed, the MSP360 RMM Agent service is abused to launch PowerShell and silently install a second, independent remote-access tool, ConnectWise ScreenConnect, via msiexec.exe /qn. This "dual-RMM" design gives the operator redundant access: removing one tool does not evict the other. ScreenConnect's built-in RunFile feature is then used to transfer and execute a battery of credential-theft and defense-evasion utilities named to mimic Windows, Defender, and Phone Link components. The activity is unattributed; Microsoft has not linked it to a named threat actor, and a parallel July 2026 cluster achieved the same outcome using Faronics Deploy Agent instead of MSP360 as the first-stage tool.

The highest-value defensive angle is not alerting on MSP360 or ScreenConnect presence alone: both are legitimate tools many MSPs run deliberately. The reliable discriminators are: (1) the distinctive _rmm_v2.5.0.67_oid filename suffix baked into every observed lure, (2) the co-occurrence of MSP360 and ScreenConnect installing on the same endpoint within a short window, and (3) the revoked code-signing certificate used on the observed installer sample.

Research decisions:

• All five fetch targets were attempted; TheCyberExpress could not be retrieved after one retry (HTTP 403) and is excluded from every claim and citation in this pack rather than paraphrased from the search snippet.
• The full text of every successfully fetched source was saved verbatim to MSP360-DualRMM-Phishing-Hunt-sources/ before any IOC was transcribed into this pack. Every atomic indicator below was checked against the saved Microsoft snapshot and traces to it.
• No prompt-injection content was found in any fetched page. The Microsoft blog's "Learn More" section links to unrelated Microsoft posts about prompt-injection defenses in Defender for Office 365; these are ordinary cross-links describing a different product feature, not instructions directed at this agent, and were not acted upon.
• Microsoft explicitly states the campaign is tracked as unattributed activity; no actor or campaign name is used anywhere in this pack beyond the vendor/product names that are the subject matter (MSP360, ConnectWise ScreenConnect).

Hunt hypotheses

Attack chain

Every atomic indicator in this pack ships detect, not prevent. That is deliberate and it is the most important thing to understand about this campaign. The binaries here are not malware. Microsoft's own IOC table labels the four service hashes "Legitimate MSP360 RMM Agent Service observed during the campaign", and the installer is the genuine MSP360 RMM v2.5.0.67 package carrying a deceptive filename. A bulk prevent import of these hashes would break MSP360 for any organization that legitimately licenses it. Microsoft does not recommend blocking them either: its guidance is to hunt for unapproved deployments and to block unapproved RMM software by publisher certificate through application control. See Section 12 for that control, and the conditional-escalation note below before changing any action value.

38 atomic indicators are carried in this pack, all traced to the saved source snapshots in MSP360-DualRMM-Phishing-Hunt-sources/. Source counts below record corroboration strength, which is a separate question from whether an indicator is safe to block.

Conditional escalation to prevent: escalate the installer SHA256/SHA1 only if MSP360 is not approved software anywhere in your estate, and only after confirming no business unit licenses it. The four service hashes should remain detect in all environments: they are stock product files, so a hit means "MSP360 is installed here", not "this host is compromised". Triage a hit by asking whether that install was authorized.

19 of the 20 techniques below are Microsoft's own published mapping for this campaign; T1562.004 is a supplementary mapping this pack adds for the firewall-rule behavior and is flagged as such.

Email gateway / M365 Defender

• Search mail flow for attachments or links to filenames matching *_rmm_v2.5.0.67_oid* or subjects themed as meeting invites, e-cards, RSVP, DHL/package delivery, job offers, or government-benefit statements, especially where the link resolves to Amazon S3, Cloudflare R2, Dropbox, GitLab, or Supabase.
• If Defender for Office 365 is in use, pull Threat Explorer for delivered messages whose payload hash matches the published installer SHA256/SHA1.

Windows Event Log (Sysmon / native)

• Sysmon Event ID 1 (process create): filter OriginalFileName or Image for the deceptive filename pattern and for RMM.Agent.exe spawning powershell.exe.
• Windows Application log, source "MSP360 RMM Agent installer": Microsoft notes the installer emits eventcreate.exe entries "Begin installation" / "End installation. MSP360 de Success.": hunt for these strings where no corresponding IT change ticket exists.
• Sysmon Event ID 13 (registry value set): hunt for autorun/Run-key writes referencing MSP360 UI components outside a known deployment window.
• Windows Firewall operational log / netsh advfirewall firewall show rule: enumerate inbound allow rules naming RMM.Agent.exe on UDP/48678 fleet-wide; this is the authoritative source of truth the CQL Q6 proxy cannot fully replace.
• Authenticode / Get-AuthenticodeSignature: spot-check any MSP360 installer found in the environment against the known-revoked certificate serial; Falcon does not expose a certificate-serial field natively (see Section 8 callout).

Software inventory / asset management

• Cross-reference your RMM/CMDB asset inventory against any host where this pack's CQL fires: a host running MSP360 or ScreenConnect without an inventory record is a strong indicator of unauthorized installation.

Falcon has no native "firewall rule added" event (FirewallMatchEvent does not exist in the sensor's data model); Q6 below is a process-command-line proxy for that behavior, not a direct read of firewall state: corroborate with the native hunt in Section 7.

// HUNT: Masqueraded MSP360 installer execution (deceptive filename pattern)
// MITRE: T1204, T1036, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: none expected; this exact string is attacker-specific and not used by legitimate MSP360 distribution packaging.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/_rmm_v2\.5\.0\.67_oid/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: Execution of known-bad MSP360 installer / RMM Agent service hashes
// MITRE: T1204, T1036, T1543.003
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: a hit is NOT automatically malicious. The installer is the genuine MSP360 package and the
//   four service hashes are stock MSP360 product files, so a licensed MSP360 deployment matches these too.
// TUNING: triage every hit against your approved-RMM asset inventory. Treat as an incident only when the host
//   has no authorizing change ticket, or when it also matches Q1 (deceptive filename) or Q5 (dual-RMM).
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| in(SHA256HashData, values=[
    "108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc",
    "f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97",
    "857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3",
    "6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e",
    "4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26"
])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: RMM.Agent.exe spawns PowerShell to stage and silently install ScreenConnect
// MITRE: T1059.001, T1218.007, T1105
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: legitimate MSPs do sometimes drive ad-hoc PowerShell through an RMM console for routine administration.
// TUNING: exclude hosts with an approved change-management ticket authorizing remote PowerShell via your RMM; treat a hit here as high-confidence only when it also appears in Q1 (deceptive installer) or Q5 (dual-RMM correlation).
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (ParentBaseFileName=/^RMM\.Agent\.exe$/i FileName=/^powershell\.exe$/i)
  or (ParentBaseFileName=/^powershell\.exe$/i FileName=/^msiexec\.exe$/i CommandLine=*ClientSetup.msi*)
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

// HUNT: Service creation for the four named MSP360 / ScreenConnect binaries
// MITRE: T1543.003
// CONF: high  FP: medium  COST: low
// REQUIRES: CreateService
// FALSE POSITIVES: both products are legitimate and widely deployed by MSPs; service creation alone does not imply compromise.
// TUNING: suppress for hosts on the approved-RMM asset inventory; treat as actionable only when correlated with Q1, Q5 (dual-RMM on the same host), or Q6 (UDP 48678 firewall rule) in the same timeframe.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=CreateService
| ServiceImagePath=/RMM\.Agent(\.Launcher)?\.exe$/i or ServiceImagePath=/ScreenConnect\.(ClientService|WindowsClient)\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])
| sort(@timestamp, order=desc)

// HUNT: Dual-RMM correlation: MSP360 and ScreenConnect installed on the same host within a short window
// MITRE: T1219, T1543.003
// CONF: high  FP: medium  COST: medium
// REQUIRES: InstalledApplication
// FALSE POSITIVES: organizations mid-migration between RMM vendors, or MSPs that legitimately run both tools fleet-wide, will also trigger this.
// TUNING: exclude hosts on a documented RMM-migration change ticket; narrow to pairs whose collected timestamps fall within 24-48 hours of each other; prioritize hits that also match Q1 or Q6.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=InstalledApplication
| selfJoinFilter(field=[aid], where=[
    {ApplicationName=/MSP360|RMM Agent/i},
    {ApplicationName=/ScreenConnect/i}
])
| groupBy([aid, ComputerName], function=[collect(ApplicationName), collect(@timestamp)], limit=5000)
| table([aid, ComputerName, ApplicationName, @timestamp])

// HUNT: Inbound UDP 48678 firewall rule created for RMM.Agent.exe
// MITRE: T1562.004
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: every legitimate MSP360 installation creates this identical rule by design; it is not unique to the malicious masquerade.
// TUNING: never alert on this query alone; only escalate when it co-occurs with Q1 (deceptive installer filename) or Q5 (ScreenConnect installed on the same host) for the same aid.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(netsh\.exe|powershell\.exe)$/i
| CommandLine=*48678*
| CommandLine=*RMM.Agent.exe*
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

// HUNT: ScreenConnect RunFile execution from the campaign's Temp staging paths
// MITRE: T1105, T1036.005, T1005
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: ScreenConnect's RunFile capability is legitimately used by MSPs to push support utilities.
// TUNING: exclude filenames matching your organization's approved support-tooling catalog; cross-reference FileName against Q8's named post-compromise utility list for higher confidence.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^ScreenConnect\.WindowsClient\.exe$/i
| CommandLine=*\ScreenConnect\Temp\*
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

// HUNT: Named post-compromise utilities matching Microsoft's observed filename set
// MITRE: T1105, T1036.005, T1005
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: a small number of these names (e.g. WindowsUpdate, PIN) could coincidentally collide with legitimately named internal tooling.
// TUNING: validate each FileName hit is not a known internal utility before escalating to containment; this list is corroborated by Microsoft (primary) and partially by GBHackers / CyberPress for the credential-theft subset.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^ScreenConnect\.(WindowsClient|ClientService)\.exe$/i
| FileName=/^(WindVerify|WindowsUpdate|WindowsSecurity_PIN|WindowsSecurity_Password|WindowsPassKey|SCHider|PIN|phonepc|DefenderDT|DefenderControl|phonelinkupdate|PhoneLinkPrompt|Passwords|OpenCamera|open_phone_link|MouseHiderGUI|HideUL|HideMouse|HideFromControlPanel|HideCursor|BannerHider|WebBrowserBookmarksView|WebBrowserPassView)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc)

// HUNT: DNS resolution of known campaign C2 domains
// MITRE: T1071.001, T1573, T1102, T1583.001
// CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: none expected; these are attacker-registered / attacker-leveraged domains, single-sourced to Microsoft's IOC table, so they ship for detection only (not blocking) pending a second source.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=DnsRequest
| DomainName=/^(adswre\.cfd|trews\.cfd|swedcorry\.stefneyv\.com|ojsuyw\.niyari\.org|bunstar\.harej\.si|adsaw\.cfd|sdfghj\.rd-team\.ru)$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc)

// HUNT: Pivot: DNS lookups of cloud platforms used for payload staging
// MITRE: T1105, T1583.006, T1102
// CONF: low  FP: high  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: extremely high; these are mainstream cloud services used by normal business operations fleet-wide.
// TUNING: never alert on this query by itself; use it only to pivot from an existing Q1/Q2 hit to confirm the download vector, or to corroborate a Q3/Q5/Q6 hit that is otherwise borderline.
// LOOKBACK: set with the Falcon time picker (recommended 7d)
#event_simpleName=DnsRequest
| DomainName=/amazonaws\.com$|dropbox\.com$|gitlab\.com$|supabase\.co$|r2\.cloudflarestorage\.com$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])
| sort(@timestamp, order=desc)

Queries with low FP and deterministic match logic are promotion candidates for a Custom IOA (real-time detection) rather than remaining scheduled-search/hunt-only. Queries with medium+ FP or behavioral correlation logic should stay as investigate-only hunts until an organization has tuned the exclusions for its own environment.

Q3, Q4, Q5, Q6, Q7, and Q10 remain investigate-only hunt queries: each carries medium-or-higher FP risk because the underlying behavior (RMM-driven PowerShell, service creation, dual-RMM presence, firewall rule creation, ScreenConnect RunFile, cloud-storage DNS) is also produced by entirely legitimate MSP operations. Promote only after environment-specific tuning.

This CSV is safe to bulk-import as written: every row is action=detect. Two separate reasons put it there. The 25 post-compromise hashes and the 7 domains are single-sourced to Microsoft and so fall below this pack's two-source bar for blocking. The installer hash, its SHA1 and the 4 service hashes clear that bar but are still detect because they are legitimate MSP360 product files, and blocking them would break a licensed MSP360 deployment. Read the conditional-escalation note in Section 4 before promoting any row to prevent. The blocking control Microsoft actually recommends for this campaign is application control by publisher certificate, covered in Section 12.

type,value,action,severity,expiration,description,tags
sha256,108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc,detect,critical,2027-04-01,Genuine MSP360 RMM v2.5.0.67 installer under deceptive filename; revoked signing cert. Escalate to prevent ONLY if MSP360 is not approved software,campaign:msp360-dualrmm-phishing
sha1,f34330d4c6e0aa978dc3af40360c14b31ad51127,detect,critical,2027-04-01,Same installer sample SHA1. Escalate to prevent ONLY if MSP360 is not approved software,campaign:msp360-dualrmm-phishing
sha256,f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97,detect,medium,2027-04-01,STOCK MSP360 RMM Agent service binary (Microsoft labels it legitimate). Do not block: a hit means MSP360 is installed,campaign:msp360-dualrmm-phishing
sha256,857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3,detect,medium,2027-04-01,STOCK MSP360 RMM Agent service binary (Microsoft labels it legitimate). Do not block: a hit means MSP360 is installed,campaign:msp360-dualrmm-phishing
sha256,6a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e,detect,medium,2027-04-01,STOCK MSP360 RMM Agent service binary (Microsoft labels it legitimate). Do not block: a hit means MSP360 is installed,campaign:msp360-dualrmm-phishing
sha256,4188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26,detect,medium,2027-04-01,STOCK MSP360 RMM Agent service binary (Microsoft labels it legitimate). Do not block: a hit means MSP360 is installed,campaign:msp360-dualrmm-phishing
sha256,ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdc,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,40f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,3ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6c,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,5bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126db,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53ef,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,1a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,06ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
sha256,a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5b,detect,high,2027-04-01,Post-compromise utility transferred/executed via ScreenConnect RunFile (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,adswre[.]cfd,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,trews[.]cfd,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,swedcorry[.]stefneyv[.]com,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,ojsuyw[.]niyari[.]org,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,bunstar[.]harej[.]si,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,adsaw[.]cfd,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing
domain,sdfghj[.]rd-team[.]ru,detect,high,2027-04-01,C2 domain contacted by ScreenConnect clients in malicious sessions (single-sourced; detect only),campaign:msp360-dualrmm-phishing

# Behavioral signatures (no single atomic value -- hunt these patterns, not a static IOC)
pattern: deceptive installer filename
  match:  FileName contains "_rmm_v2.5.0.67_oid"
  examples (verbatim from source): VIP_ECARD_INVITATION_rmm_v2.5.0.67_oid[redacted].exe
                                    ZoomSetup_Installation_v2.5.0.67_oid[redacted].exe
                                    SSA.GOV_STATEMENT_rmm_v2.5.0.67_oid[redacted].exe

pattern: dual-RMM co-occurrence (HIGHEST FIDELITY)
  match:  InstalledApplication shows both an MSP360/RMM Agent entry and a ScreenConnect
          entry for the same aid, with install timestamps within ~24-48h of each other

pattern: revoked code-signing certificate
  match:  installer's Authenticode certificate has been revoked since the campaign was
          reported; validate any MSP360 installer binary found in the environment against
          current CRL/OCSP status, not just against the published hash list

pattern: UDP/48678 firewall allow-rule for RMM.Agent.exe
  match:  netsh advfirewall firewall show rule | findstr /i "RMM.Agent.exe 48678"
  caveat: created by EVERY MSP360 install, legitimate or not -- corroborating signal only

# Named tooling observed via ScreenConnect RunFile (Microsoft primary source)
# Masquerade targets: Windows Update, Windows Security, Microsoft Defender, Phone Link
WindVerify.exe              WindowsUpdate.exe           WindowsSecurity_PIN.exe
WindowsSecurity_Password.exe WindowsPassKey.exe          SCHider.exe
PIN.exe                     phonepc.exe                 DefenderDT.exe
DefenderControl.exe         phonelinkupdate.exe         PhoneLinkPrompt.exe
Passwords.EXE               OpenCamera.exe               open_phone_link.exe
MouseHiderGUI.exe           HideUL.exe                   HideMouseApp.dll
HideMouse.exe               HideFromControlPanel.exe     HideCursor.exe
BannerHider.exe             WebBrowserBookmarksView.exe  WebBrowserPassView.exe

# Staging paths
C:\Users\%user%\OneDrive\Documents\ScreenConnect\Temp\
C:\Users\%user%\Documents\ScreenConnect\Temp\

# Patch / ASR / CA audit checklist (run across the fleet)

# 1. ASR rule: block process creations from PsExec and WMI commands (Microsoft's own
#    recommendation for this campaign) -- GUID d1e49aac-8f56-4280-b9ba-993a6d77406c
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

# 2. Confirm cloud-delivered protection is enabled (Microsoft's own recommendation)
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent

# 3. Enumerate the UDP/48678 firewall rule fleet-wide
Get-NetFirewallRule | Where-Object { $_.DisplayName -match 'RMM' } |
  Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq 48678 }

# 4. Inventory MSP360 / ScreenConnect installs without a matching change ticket
Get-CimInstance Win32_Product | Where-Object { $_.Name -match 'MSP360|ScreenConnect' } |
  Select-Object Name, Version, InstallDate, PSComputerName

# 5. Confirm MFA is enforced on the approved RMM platform's admin console
#    (vendor-specific; no single PowerShell check -- verify in the RMM vendor's
#    identity/SSO configuration)

Playbook 1, ASR rule: block PsExec/WMI process creation

# Playbook 1: Enable ASR rule to block PsExec/WMI-originated process creation
# Prerequisites: Windows 10 1709+/Server 2019+, Defender Antivirus active, tested in Audit mode first
# Reboot required: No

Set-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c `
  -AttackSurfaceReductionRules_Actions AuditMode   # Step 1: audit for 1-2 weeks, review Event ID 1121/1122

Set-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c `
  -AttackSurfaceReductionRules_Actions Enabled     # Step 2: enforce after audit review is clean

# Rollback: revert to AuditMode or Disabled
Set-MpPreference -AttackSurfaceReductionRules_Ids d1e49aac-8f56-4280-b9ba-993a6d77406c `
  -AttackSurfaceReductionRules_Actions Disabled

Playbook 2, block the installer hash via Defender for Endpoint indicators

# Playbook 2: Block the campaign's installer hash via Defender for Endpoint indicators
# Prerequisites: Microsoft Defender for Endpoint P1/P2 license, Security Admin role for indicator management
# Reboot required: No

# Via Microsoft Graph Security API (or Security Center UI: Settings > Indicators > File hash):
POST https://api.securitycenter.microsoft.com/api/indicators
{
  "indicatorValue": "108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc",
  "indicatorType": "FileSha256",
  "action": "Block",
  "title": "MSP360 dual-RMM phishing - masqueraded installer",
  "severity": "High"
}
# Repeat for the SHA1 (f34330d4c6e0aa978dc3af40360c14b31ad51127) and the 4 service
# SHA256 hashes in Section 10.

# Rollback: DELETE https://api.securitycenter.microsoft.com/api/indicators/{indicator-id}
# or remove the entry from Security Center > Settings > Indicators

Playbook 3, AppLocker publisher-deny rule for unapproved RMM installers

# Playbook 3: AppLocker publisher-deny rule for unapproved RMM installers
# Prerequisites: AppLocker policy infrastructure in place (GPO or Intune), Application Identity service running
# Reboot required: No (policy refresh via gpupdate /force is sufficient)

# Example rule (apply via Set-AppLockerPolicy -XMLPolicy or Group Policy Editor):
# Deny EXE rule scoped to the revoked/compromised certificate publisher, with an
# explicit exception for your organization's approved MSP360 deployment certificate.
<FilePublisherRule Id="<GUID>" Name="Deny-Unapproved-MSP360-Cert" Action="Deny" UserOrGroupSid="S-1-1-0">
  <Conditions>
    <FilePublisherCondition PublisherName="O=MSP360 (REVOKED CERT SERIAL)" ProductName="*" BinaryName="*">
      <BinaryVersionRange LowSection="*" HighSection="*" />
    </FilePublisherCondition>
  </Conditions>
</FilePublisherRule>

# Validate: gpresult /r   (confirm AppLocker policy applied)
# Rollback: remove the rule from the policy and re-push via Set-AppLockerPolicy, or
#           Set-AppLockerPolicy -XMLPolicy <previous-policy.xml> -Merge:$false

Playbook 4, audit and remove the UDP/48678 firewall rule

# Playbook 4: Fleet audit and removal of the UDP/48678 RMM.Agent.exe firewall rule
# Prerequisites: Local admin / remote PowerShell (WinRM) to target hosts; confirm host is NOT an
#                approved MSP360 deployment before removing the rule
# Reboot required: No

# Step 1 - Audit (read-only, safe to run everywhere)
Get-NetFirewallRule | Where-Object { $_.DisplayName -match 'RMM' } |
  ForEach-Object { $_ | Get-NetFirewallPortFilter | Where-Object { $_.LocalPort -eq 48678 } }

# Step 2 - Remove ONLY on hosts confirmed unauthorized (no matching asset-inventory record)
Get-NetFirewallRule | Where-Object { $_.DisplayName -match 'RMM' } | Remove-NetFirewallRule

# Rollback: if the host is later confirmed to be a legitimate MSP360 deployment, re-add:
New-NetFirewallRule -DisplayName "MSP360 RMM Agent" -Direction Inbound -Protocol UDP `
  -LocalPort 48678 -Program "C:\Program Files\RMM Agent\RMM.Agent.exe" -Action Allow

All validation gates from Section 11 pass except Benign baseline and Positive test, which are tenant-specific and must be completed locally before Q4, Q5, and Q6 are promoted beyond investigate-only status.