Affected Systems

Organizations across 46 countries, primarily United States (45% of activity), Canada, and others. Top targeted sectors: education, technology, government, banking, finance, and manufacturing. Campaign abuses legitimate RMM software through phishing lures (tax forms, shipping notices, invoices, Adobe PDFs). 601 connected cases identified by ANY.RUN research.

Exploitation Status

Active campaign ongoing as of September 2026. Attackers use rapidly rotating infrastructure (425 kit URLs across 240 hosts, 94% observed for only one day). Delivery via Vercel, GitHub Pages, Netlify, compromised sites, Amazon S3, Cloudflare R2, DigitalOcean Spaces, Dropbox, and GoFile. Daily infrastructure rotation complicates tracking.

Business Impact

Legitimate RMM software abuse enables unauthorized remote access to corporate systems, bypassing traditional malware detection. Rapid infrastructure rotation (daily domain changes) defeats IOC-based blocking. Password-protected archives evade email gateway inspection. High-value sectors (government, finance, education) targeted. SOC teams face detection challenges due to legitimate software abuse and disposable infrastructure masking malicious intent.

Urgency

đźź  Within 24 hours

Recommended Actions

  • Monitor for unauthorized RMM software installations (AnyDesk, TeamViewer, ScreenConnect, etc.) via endpoint detection tools and application whitelisting policies
  • Block or alert on delivery chain indicators: font1.woff2 / fmtt assets, icons8-microsoft-word-94.png, and secure.html → project/*.zip file patterns in web proxy and email gateway logs
  • Implement mail-layer controls to flag or quarantine password-protected archives, especially those with tax, shipping, or invoice themes in subject lines
  • Establish behavioral detection rules for browser-initiated downloads followed by immediate RMM process execution within short time windows
  • Conduct user awareness training focused on tax form, shipping notification, and Adobe PDF phishing lures; emphasize verification of sender authenticity before opening attachments

---

# Geopolitical Context

Geopolitical Context

This campaign represents a financially motivated, geographically dispersed operation that exploits trust in government institutions and commercial services across multiple jurisdictions. The use of localized lures—including Canada Revenue Agency tax forms, US Social Security Administration themes, and shipping notifications—indicates a sophisticated understanding of regional administrative processes and social engineering vectors. The campaign's scale (46 countries, 601 documented cases) and targeting of critical sectors including government, education, technology, banking, and manufacturing suggests either a well-resourced criminal enterprise or coordinated activity by multiple threat actors sharing infrastructure and techniques. The absence of clear ideological or espionage indicators points toward financially motivated cybercrime, though the breadth of government sector targeting warrants continued monitoring for potential dual-use or intelligence collection objectives.

State Actor Alignment

No state actor attribution is provided in available reporting. The campaign's characteristics—use of legitimate RMM tools, rapid infrastructure rotation via commercial platforms (Vercel, GitHub Pages, Netlify, Amazon S3, Cloudflare R2), and financially motivated social engineering—are consistent with transnational cybercriminal operations rather than state-sponsored activity. The targeting pattern lacks the sectoral focus typically associated with espionage campaigns, though government sector presence (alongside education and finance) suggests opportunistic credential harvesting that could serve multiple purposes. No sanctions designations, government advisories, or formal attributions have been linked to this activity as of the reporting date.

Business Impacty pro region

The campaign's North American concentration (45% US, with Canada as the initial identified target) poses particular risks to cross-border economic activity and government service delivery. The exploitation of trusted government brands (CRA, SSA) undermines public confidence in digital communications from tax and social welfare authorities during critical filing periods. European presence within the 46-country footprint suggests transatlantic coordination challenges for law enforcement, particularly given the abuse of legitimate cloud infrastructure providers operating across multiple jurisdictions. For critical infrastructure sectors (government, education, finance, manufacturing), the campaign demonstrates how commodity cybercrime can achieve strategic effects through volume and persistence, even without sophisticated technical capabilities. The use of US-based cloud platforms (Amazon S3, DigitalOcean, Cloudflare) for malicious infrastructure highlights ongoing challenges in balancing platform openness with abuse prevention, a recurring tension in transatlantic digital policy discussions.

Forecast

If current infrastructure rotation patterns persist, detection and disruption efforts will likely require sustained coordination among cloud service providers, domain registrars, and international law enforcement rather than traditional indicator-based blocking. Should the campaign continue targeting government and financial sectors at scale, regulatory pressure on RMM software vendors to implement stronger authentication and deployment controls may increase, particularly in jurisdictions with strict data protection regimes. If threat actors maintain their current operational security posture—daily infrastructure rotation with stable phishing kit fingerprints—defenders who invest in behavioral detection and shared threat intelligence platforms will likely achieve better detection rates than those relying solely on reputation-based controls. The campaign's geographic expansion suggests that additional countries, particularly those with similar tax filing cycles or government service digitization initiatives, may see increased activity in coming months if the operation remains profitable for its operators.