Datto RMM

Once the CAPTCHA was solved, a download button appeared, and a file named DownloadedOneDriveDocument.exe was silently fetched from an external host, but since the process ran entirely within the n8n domain’s JavaScript, the download appeared to come from the trusted n8n infrastructure itself.

Threat actors are weaponizing party invitation-themed emails to steal credentials and install malware on victims’ machines.

These phishing emails use fake event invitations that request the recipient to click on a link to accept. When clicked, the link goes to a page containing another link that downloads the malware depending on the operating system.

The malicious executable employed in this campaign uses PowerShell commands to deploy the Datto RMM tool, configure it as a scheduled task, and establish persistence

The malicious executable employed in this campaign uses PowerShell commands to deploy the Datto RMM tool, configure it as a scheduled task, and establish persistence

Once the CAPTCHA was solved, a download button appeared, and a file named DownloadedOneDriveDocument.exe was silently fetched from an external host... When executed, this file installed a modified version of the Datto Remote Monitoring and Management (RMM) tool.

"To proceed, victims must download and execute a provided ‘update’ before being allowed to join."

The malicious executable employed in this campaign uses PowerShell commands to deploy the Datto RMM tool, configure it as a scheduled task, and establish persistence

The malicious executable employed in this campaign uses PowerShell commands to deploy the Datto RMM tool, configure it as a scheduled task, and establish persistence

a threat actor uses an Adobe-spoofing email to deliver GoTo RAT... directed to a website that impersonates the invitation website.

The malicious executable employed in this campaign uses PowerShell commands to deploy the Datto RMM tool... before deleting traces of the payload.

"The payload, disguised as a software update, is a digitally signed remote monitoring and management (RMM) tool..."

"These tools enable attackers to remotely access victims’ machines and gain full administrative control over their endpoints"

Once installed, the initial RAT may automatically download a secondary RAT or retrieve one when instructed by a command-and-control (C2) server.

Installation de Cloudflared comme service Windows; Datto RMM a également été déployé sur un poste.

C2s allow the threat actor to both exfiltrate data and load additional malware onto the machine.