Affected Systems

Organizations across multiple industries targeted via phishing. Legitimate MSP360 RMM v2.5.0.67 installer abused to deploy ConnectWise ScreenConnect, creating redundant remote-access channels. No software vulnerabilities exploited—attackers abuse legitimate RMM functionality.

Exploitation Status

Active campaign observed by Microsoft Defender Experts in July 2024. Threat actors actively distributing masqueraded MSP360 RMM installers via phishing emails and social engineering lures. No CVE exploitation—abuse of legitimate remote administration tools.

Business Impact

Attackers establish persistent remote access using trusted administrative software (MSP360 RMM, ScreenConnect), blending into normal IT operations and evading detection. Post-compromise activity includes credential theft, information collection, and deployment of additional tooling. Redundant access channels complicate remediation. Organizations with unmanaged or shadow IT RMM deployments face elevated risk.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all MSP360 RMM and ScreenConnect installations; verify legitimacy and authorization with IT/MSP teams, especially version 2.5.0.67 (SHA256: 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc)
  • Block or alert on execution of RMM installers from user Downloads directories and non-standard paths; enforce application control policies restricting unapproved remote administration tools
  • Hunt for suspicious MSP360 service installations and ScreenConnect clients using Microsoft Defender for Endpoint hunting queries; review PowerShell execution logs for RMM-initiated downloads
  • Implement email filtering rules to block phishing lures impersonating meeting invitations, PDF readers, Zoom installers, and document-sharing portals; educate users on social engineering tactics
  • Monitor outbound connections to cloud storage services (Amazon S3, Cloudflare R2, Dropbox, GitLab, Supabase) from endpoints for unexpected RMM installer downloads; review firewall and proxy logs for anomalous RMM traffic