Phishing campaign uses signed MSP360 installers to plant ScreenConnect as a backup channel

The binary at the front of the chain is a digitally signed MSP360 RMM v2.5.0.67 installer ^[5]. Only the names are fake: ZoomSetup_Installation, SSA.GOV_STATEMENT, VIP_ECARD_INVITATION and "PDF Reader & Editor the Adobe Acrobatte", each with the real version string attached ^[6]. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected devices and enabled threat actors to gain an initial foothold using trusted administrative software," the Microsoft Security Research team said ^[3].

On the endpoint, the installer drops several DLLs and relaunches itself through the Windows UAC elevation workflow to run privileged ^[8]. It enumerates installed .NET runtimes, registers two services, RMM.Agent.exe and RMM.Agent.Launcher.exe, and writes Registry autorun entries so MSP360 starts at every user sign-in ^[10]. It opens Windows Firewall to inbound UDP traffic on port 48678 for RMM.Agent.exe ^[11]. Then it uses the MSP360 agent to run PowerShell, and that PowerShell installs ScreenConnect ^[2]. Later payloads go through ScreenConnect's native RunFile function ^[4].

"The combination of MSP360 and ScreenConnect provided the threat actor with redundant remote administration channels and enabled the transfer, execution, and management of additional tooling during subsequent stages of the intrusion," Microsoft said ^[9]. Across the two July sets, the first-stage tool changed from MSP360 to Faronics Deploy Agent, and ScreenConnect was the second stage both times ^[18]. Microsoft placed the campaign in a continuing pattern. "This activity highlights how threat actors continue to abuse legitimate remote administration software to blend into normal IT operations while maintaining persistent access and reducing detection opportunities," the company said ^[15].

The Hacker News report does not list Microsoft's recommended mitigations ^[16]. In my view the control that fits is an allowlist of the RMM products an organisation actually runs. Neither July first stage gets past it unless MSP360 or Faronics Deploy Agent is already sanctioned on that network ^[19]. Where one of them is, the next check is a second RMM agent arriving on a host that already has one, or an RMM agent process spawning PowerShell that installs another remote-access client ^[2]. The inbound UDP 48678 rule is a narrower indicator, specific to the MSP360 agent in this campaign ^[11].