Loading story…
Rapid7 reported multiple intrusions tied to an ongoing social-engineering campaign that starts with email bombing and follow-up calls, often over Microsoft Teams, to pressure users into installing AnyDesk. In the observed June 2024 cases, the operators moved away from earlier Quick Assist and batch-script tradecraft and instead used a signed .NET credential harvester, AntiSpam.exe, followed by payloads masquerading as software updates. Those payloads included SystemBC, Golang HTTP beacons, SOCKS proxy implants, a PowerShell proxy script, reverse SSH tunnels, and Level RMM for persistence and lateral movement, with several binaries signed by the same certificate to appear legitimate.
Rapid7 said one payload, update6.exe, attempted to exploit CVE-2022-26923 to add a machine account for privilege escalation on vulnerable domain controllers, then moved to Kerberoasting by requesting Kerberos service tickets tied to service principal names and cracking them offline to recover service-account credentials. That technique can provide valid account access and support further privilege escalation, persistence, and lateral movement inside Windows domains. Rapid7 published indicators of compromise and urged defenders to use application allowlisting, block unapproved remote monitoring and management tools and related domains, train users to resist help-desk impersonation, and patch systems exposed to CVE-2022-26923.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Rapid7 disclosed the campaign's updated tradecraft, malware details, indicators of compromise, and defensive recommendations including allowlisting, blocking unapproved RMM tools and related domains, user awareness training, and patching CVE-2022-26923.
Rapid7 identified multiple intrusion attempts on June 20, 2024 that matched an ongoing social-engineering campaign using email bombing and follow-up calls, often via Microsoft Teams, to convince users to install AnyDesk. In these newer intrusions, the actors had shifted away from earlier Quick Assist tradecraft.
Rapid7 observed update6.exe attempting to exploit CVE-2022-26923 by adding a machine account when a vulnerable domain controller was present. The technique was then used for privilege escalation and Kerberoasting in affected environments.
After harvesting credentials, the actors executed multiple disguised payloads including SystemBC, Golang HTTP beacons, SOCKS proxy implants, a PowerShell proxy script, reverse SSH tunnels, and the Level RMM tool. Rapid7 also noted many of the compiled payloads were code-signed with shared certificates, indicating coordinated malware development.
In the recent cases Rapid7 analyzed, the threat actors replaced a prior credential-harvesting batch script with a signed .NET executable named AntiSpam.exe. The malware prompted users for credentials, validated them, and collected system and user-account enumeration data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two separate social-engineering campaigns are abusing legitimate remote access software to obtain interactive control of victim systems. One phishing operation uses **fake party invitation** emails—often appearing to come from **compromised email accounts**—to lure recipients to a spoofed invitation webpage that pressures them to download and run an `RSVPPartyInvitationCard.msi` installer. Malwarebytes researchers reported the activity primarily targeting the **UK**, with the MSI using `msiexec.exe` to silently install the **ScreenConnect** remote support client, enabling attackers to access files, credentials, and other sensitive data. A different, automated campaign is targeting **RustDesk** users by bombarding exposed RustDesk IDs with unsolicited connection requests labeled **“Go Client”** from many IPs/IDs. The activity is described as **not exploiting a RustDesk vulnerability**; instead it relies on users mistakenly clicking **Accept**, after which the botnet can run scripted actions to deploy additional malware and establish persistence. Recommended mitigations include refusing unexpected connection prompts and configuring RustDesk to require a **password** (and strong credentials) for session acceptance, reducing the risk of one-click authorization leading to takeover.
Jun 29, 2026
A social-engineering campaign targeting employees at **financial and healthcare** organizations is abusing **Microsoft Teams** chats/calls to trick users into granting remote access via *Windows Quick Assist*, enabling deployment of a newly identified malware family dubbed **A0Backdoor**. The activity begins with **email bombing** (flooding inboxes with spam) followed by an attacker impersonating internal IT over Teams, offering help and then persuading the victim to start a Quick Assist session; the tradecraft overlaps with tactics previously attributed to **Blitz Brigantine / Storm-1811**, which Microsoft has linked to **Black Basta**-associated operations. Post-access, the actor deploys **digitally signed MSI installers** masquerading as Teams-related components and *CrossDeviceService* (associated with Windows *Phone Link*), sometimes delivered via **tokenized links** from Microsoft personal cloud storage to appear trustworthy and hinder collection. BlueVoyant reported the installers drop files into user `AppData` paths that mimic legitimate Microsoft locations and use **DLL sideloading** (e.g., a malicious `hostfxr.dll`) to execute an in-memory loader that decrypts shellcode, performs sandbox checks, and ultimately extracts and runs **A0Backdoor** (using **AES**-encrypted payloads and a **SHA-256**-derived key), with anti-analysis behavior including excessive thread creation intended to disrupt debugging.
Jun 29, 2026
Multiple reports describe **social-engineering-led initial access** that pivots into malware execution and credential/financial theft. A documented “pig butchering” approach abuses the higher-trust dynamics of matrimonial platforms to build rapport and then steer victims toward cryptocurrency-related actions. Separately, an “inbound” recruitment lure targets **Web3/crypto professionals** by impersonating legitimate companies and driving candidates to install fake interview software (e.g., `collaborex_setup.msi`) that initiates command-and-control to infrastructure such as `179.43.159.106`, with the added risk that victims often use corporate endpoints that also have personal wallets installed. In parallel, technical reporting highlights enterprise-focused malware delivery via trojanized software and email. **ValleyRAT_S2** (a C++ second-stage backdoor/RAT) is being distributed via fake Chinese-language productivity tools, cracked software, and trojanized installers, including **DLL side-loading** (e.g., a malicious `steam_api64.dll`) and C2 over custom TCP (e.g., `27.124.3.175:14852`), enabling long-term control and theft of financial data. Kaspersky also reported a malicious-email wave against Russian private-sector organizations using a PDF-icon masquerade that drops a .NET downloader, installs a persistent service, and stages payloads under `C:\ProgramData\Microsoft Diagnostic\Tasks` before delivering an **infostealer**. A separate blog post discusses phishing enabled by **misconfigured Microsoft 365/hybrid Exchange mail routing and weak SPF/DKIM/DMARC enforcement**, allowing spoofed “internal” emails that can facilitate credential theft and BEC; while related in theme (phishing), it is not clearly tied to the same malware campaigns described elsewhere.
Jun 29, 2026