CISA, NSA and MS-ISAC: ScreenConnect and AnyDesk ran as portable backdoors on federal networks

The control that fails here is one most organisations file under "done": software allowlisting plus installation auditing. According to the joint advisory, the actors did not install the downloaded RMM clients on compromised hosts at all. They ran AnyDesk and ScreenConnect as self-contained portable executables, already configured to connect to the actor's own RMM server ^[4]. A portable executable launches inside the user's context with no installation step and no administrator privilege, so unapproved software can execute even where a risk management control exists to audit or block installing that same software ^[5]. The advisory's own framing is that this bypasses common software controls and risk management assumptions ^[5].

The delivery path was built to miss the same inspection points. Help desk themed emails went to federal civilian staff at both personal and government addresses, and they either carried a link to a first-stage domain or simply asked the recipient to call ^[11]. In mid-June 2022, an employee at a federal civilian executive branch agency got one of the phone-number variants at their government address, rang it, and was talked into visiting myhelpcare[.]online ^[7]. Visiting the first-stage domain downloaded an executable, which then reached a second-stage domain to pull down the RMM software ^[12]. The vendor binary never crosses the mail gateway.

The arithmetic on that is worth stating. Earliest observed activity on a federal network was mid-June 2022 ^[7]; CISA identified the campaign in October 2022, working from trusted third-party reporting and retrospective analysis of EINSTEIN, the intrusion detection system it runs across federal civilian networks ^[2][6]. That is roughly four months between the first foothold visible in hindsight and the campaign being recognised as a campaign ^[15]. There was bi-directional traffic between a federal network and myhelpcare[.]cc as late as mid-September 2022 ^[8], a month before identification.

Retrospection found two networks first, and further EINSTEIN analysis and incident response found related activity on many other federal civilian networks ^[6][9]. The signal that eventually carried was network telemetry read backwards, not an endpoint verdict at execution time. CISA also links the campaign to typosquatting infrastructure reported by Silent Push that impersonated Amazon, Microsoft, Geek Squad, McAfee, Norton and PayPal ^[10], which is the same help desk pretext at scale.

The observed monetisation was mundane: a refund scam that moved money out of victim bank accounts ^[2]. The authoring organisations' assessment is the part defenders should price, which is that the same access can be sold on to other criminal or APT buyers ^[3], and that criminal and state-sponsored actors alike are known to keep legitimate RMM software in place as a backdoor for persistence or command and control ^[13]. A live, authenticated remote control session is a better product to resell than a credential dump.

Which leaves the discriminating field. It is not the process name, because the process name is the one your help desk approved. It is which RMM server the client authenticates to ^[4], and that is not a field most software inventories keep. The advisory points defenders at its own IOC and mitigation sections for the rest ^[14].