ITarian

The operator registered 32 throwaway domains on cheap TLDs and used 7 dynamic-DNS names to serve the same kit.

The operator used 82 one-shot *.vercel[.]app deployments, one Netlify app, and *.github[.]io pages to host the lure kit.

The operator used compromised legitimate websites — 8 confirmed in this arm, 117 conventional sites family-wide — to serve the icons8-microsoft-word-94.png kit path.

SimpleHelp ... is often used in phishing campaigns involving “invitation” lures in which the victim is encouraged to download and execute an invite to a party (e.g. Ecard9140.exe ).

A common lure is themed as a Social Security statement ( ssa.msi ) in an attempt to convince the victim they need to run the file to retrieve their statement.

“The victims received a phishing email that appeared to be a document share ‘via ScreenConnect’” and “The phishing links led to a legitimate (but abused) domain for an Adobe InDesign-hosted lure page.”

“PowerShell fetches an RMM installer.”

“Clicking ‘View Document’ redirects to an attacker-controlled C2 infrastructure that deploys the malicious payload” and the PDF used “an embedded link” to trick an employee into installing ITarian.

Once run, it installs a service called HostService , which runs Program Files (x86)\RemotePC Host\HostService.exe , which in turn runs the process remotepcservice.exe .

Once run, it installs a service called HostService , which runs Program Files (x86)\RemotePC Host\HostService.exe , which in turn runs the process remotepcservice.exe .

Because the installer is signed and generated by PDQ, it bypasses many basic reputation checks.

Syncro often runs msiexec.exe to sideload further RMM tools, usually ScreenConnect, which is highly suspicious.

Over the last few years, threat actors have flocked to exploit legitimate remote monitoring and management (RMM) tools—blue-chip IT software like ScreenConnect, LogMeIn Resolve, and PDQ Connect—blurring the line between legitimate IT administration and malicious intrusion.

“PowerShell fetches an RMM installer.”

“The employee didn't know the file they opened would lead to an attacker's successful intrusion, ultimately installing a rogue ITarian client, followed by a ScreenConnect session for persistent access.”