Loading story…
Attackers exploited ConnectWise ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709 to gain access to exposed systems and deploy a malware sample that Kroll said closely resembles BABYSHARK, a family previously associated with North Korea-linked Kimsuky activity. In the observed intrusion, the actor abused the ScreenConnect setup wizard for initial access, launched mshta.exe, and retrieved a heavily obfuscated VBScript payload designed to generate unique code, junk content, and changing second-stage URLs on each download.
The malware gathered host, user, network, process, and security-tool information, altered Microsoft Office VBA warning registry settings, and used certutil to encode stolen data into PEM format before exfiltrating it to command-and-control infrastructure. It also established persistence through a scheduled task that executed VBScript from an Alternate Data Stream and checked a unique URL every minute for follow-on code, behavior consistent with selective payload delivery. The activity aligns with earlier reporting on Kimsuky’s evolving reconnaissance tradecraft and prior BABYSHARK operations targeting policy and national security organizations.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Kroll publicly described the attempted compromise, including the use of mshta-delivered obfuscated VBScript, host reconnaissance, registry changes to lower Office macro protections, data exfiltration, and persistence via a scheduled task named Uso1Cache. The report also noted the malware used changing payload URLs and likely selective follow-on delivery from command-and-control infrastructure.
SentinelOne published research on a new global Kimsuky campaign that showed the group's reconnaissance capabilities evolving, providing prior context for malware and tradecraft later compared to BABYSHARK activity.
Kroll detected and stopped an attempted intrusion in which a threat actor exploited ConnectWise ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709 to access a victim workstation and deploy a new malware sample. Based on code and behavioral overlap, Kroll assessed the malware was likely a BABYSHARK variant previously associated with Kimsuky.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
kroll.com
Open sourcesentinelone.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported an active **Smoke#Screen** social-engineering campaign that tricks victims into installing the legitimate, ConnectWise-signed **ScreenConnect** remote monitoring and management tool, giving attackers persistent remote access while blending in with normal IT activity. The operation targets both **Windows** and **macOS** users and uses multiple lures, including fake **Zoom** and **Adobe** updates, document-review requests, and a **SystemCheck** maintenance tool. Securonix linked the activity to a live staging server at `207.174.0.143:8080`, reconstructed five kill chains, and tied the campaign to three attacker-controlled ScreenConnect relay clusters. The attackers rotated payloads between download sessions and used a mix of **VBScript droppers**, batch loaders, compiled **.NET** executables, phishing HTML pages, **Dropbox** links, **Cloudflare Quick Tunnels**, encrypted bundles, and a **WsgiDAV** staging server to frustrate hash-, signature-, and reputation-based detection. Researchers said the tradecraft evolved from obfuscated, sandbox-aware droppers to loaders that disabled Microsoft Defender and later to stealthier variants that delayed execution to evade Elastic correlation, underscoring that **behavioral detection** is more effective than relying on software trust or static indicators alone.
Aug 7, 2026
Huntress identified a campaign in which attackers use social engineering—including fake technical support, phishing, fraudulent refund-search results, and Quick Assist abuse—to persuade victims to install trojanized ConnectWise ScreenConnect clients. Rather than exploiting a ScreenConnect vulnerability, the altered remote-support software detects incoming sessions and uses ScreenConnect file-transfer and remote-execution functions to send a staged four-part VBScript loader to the connecting endpoint, potentially infecting technician and help-desk systems without further user interaction. The payload chain profiles hosts, establishes persistence, seeks elevated execution, and can deploy remote-access, tunneling, and cryptocurrency-mining tools while attempting to evade security controls, including Microsoft Defender reporting and User Account Control. Huntress observed the activity at unrelated organizations during late-August incidents and advises organizations to reimage confirmed compromised systems, review ScreenConnect deployments and audit logs, and investigate suspicious Windows Script Host or PowerShell execution linked to ScreenConnect sessions.
Sep 8, 2026
North Korean state-backed threat group **Kimsuky** has been linked to an ongoing spear-phishing campaign targeting organizations and individuals in the United States, Europe, and Asia, including think tanks, research universities, government entities, and staff at Korea Risk Group. Researchers said the operation uses tailored phishing emails and **OneDrive-hosted password-protected documents** containing malicious Microsoft Office macros to gain initial access. The campaign delivers a new reconnaissance malware component dubbed **ReconShark**, assessed as an evolved variant of BabyShark. ReconShark gathers host data including running processes, battery status, and installed security products, then exfiltrates the information via HTTP `POST` requests without first writing it to disk. Based on the victim environment, the malware can also deploy follow-on payloads such as VBS, HTA, batch scripts, DLLs, malicious Office templates, and modified LNK files; supporting infrastructure was identified on NameCheap-hosted shared servers tied to domains including `yonsei[.]lol`, `rfa[.]ink`, `mitmail[.]tech`, and `newshare[.]online`.
Jun 29, 2026