A sophisticated credential-harvesting campaign has been targeting ScreenConnect cloud administrators for years and may be opening the door to ransomware attacks, researchers at Mimecast said in a blog post released Monday.
The campaign uses compromised Amazon Simple Email Service accounts to spear-phish senior IT administrators who have elevated privileges in ScreenConnect environments. The hackers are targeting super-administrator credentials, which provide extensive control of companies’ remote-access infrastructure, according to Mimecast researchers.
“ScreenConnect is a great way for the ransomware group to not only obtain credentials from someone with the correct level of access but understand the organizational assets and then push through malicious content when they are ready,” Mimecast researchers told Cybersecurity Dive.
The phishing pages use adversary-in-the-middle techniques and an open-source tool called EvilGinx, which the researchers said allow the hackers to bypass authentication and maintain persistence.
The campaign, which began in 2022, has connections to ransomware activity by affiliates of the Qilin group. Attackers can use the super-administrator credentials to install ScreenConnect instances they control on multiple computers at the same time, which helps them move laterally across a network and increases their ability to distribute ransomware, Mimecast researchers said.
Sophos researchers in April warned about an attack against a managed service provider with what appeared to be an authentication alert for a ScreenConnect remote monitoring and management tool. That incident allowed Qilin ransomware affiliates to access administrator credentials and launch downstream attacks.
“They crafted a phishing email that appeared to be a legitimate ScreenConnect alert, but it was malicious,” Anthony Bradshaw, MDR incident response manager at Sophos, told Cybersecurity Dive.
Qilin “exfiltrated and encrypted multiple systems,” Bradshaw said, leaving ransom notes for these victims. Sophos has tracked the threat activity under the name STAC4365.
Qilin is a sophisticated ransomware-as-a-service actor linked to multiple high-profile attacks, including one against media giant Lee Enterprises. The group also claimed credit for the attack against Inotiv earlier this month.
