Loading story…
SOCRadar linked hundreds of phishing campaigns impersonating the IRS, Social Security Administration, DocuSign, and other trusted brands to a phishing-as-a-service operation known as The Quarry. The service, attributed to a developer using the aliases RockyBelling, Rock, Rockky, and Mike, has been active since at least April 2025 and supports nearly 200 affiliates. Researchers identified more than 80 domains, over 40 ConnectWise ScreenConnect panels, and more than 500 victim IPs across 14 countries, with over 90% of observed victims located in the United States.
Rather than relying primarily on conventional malware, the operation used legitimate remote monitoring and management software—especially ScreenConnect—to gain remote access while evading detection. The toolkit used layered filtering, Adspect-based cloaking, bulk email tooling, Telegram-based coordination and exfiltration, and in April 2026 added a VBS dropper with UAC bypass that fetched ScreenConnect installers and decoy PDFs from GitHub or GitLab. Post-compromise activity included browser history collection, W-2 harvesting, credential and cookie theft via VioletRAT, and suspected monetization through financial fraud, tax-related identity theft, initial access brokerage, and possible resale of access to ransomware operators.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
In April 2026, the developer behind The Quarry added a VBS dropper with UAC bypass that downloads and installs ConnectWise ScreenConnect while showing a decoy PDF, enabling infection outside the normal phishing-page flow.
SOCRadar reported that The Quarry phishing-as-a-service ecosystem had been active since at least April 2025, supporting phishing campaigns impersonating the IRS, SSA, and other trusted brands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Nigerian-linked threat actor ran at least 10 phishing campaigns from infrastructure associated with `zoom4usinvite[.]space` and a cPanel account at `vistejet[.]com`, impersonating brands including the U.S. Social Security Administration, Zoom, Adobe, Google, Microsoft, Xfinity, VistaJet, and Paperless Post. The operation used adversary-in-the-middle phishing kits to steal credentials, payment-card and Social Security numbers, and real-time MFA codes, with Telegram bots supporting immediate credential collection and session control. Researchers linked kit development artifacts to the handle `@xforgex` and cited Nigerian mobile-provider allowlisting and Lagos MTN development-log access as evidence of the operator's origin. One SSA-themed email campaign used `Information@allsecured[.]net` and a shortened `t[.]co` URL to direct victims to a fake SSA download site at `icci-sa[.]com`, where they received `ScreenConnect.ClientSetup.exe`. The customized ScreenConnect installer communicated with `15.204.43[.]235` over TCP/443 using encrypted ScreenConnect traffic, providing the operator potential remote-access backdoor capability. The broader infrastructure also distributed ScreenConnect and FleetDeck remote-management agents through BAT, HTA, MSI, and EXE payloads, combining financial-data theft and account takeover with persistent endpoint access.
Sep 21, 2026
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026