Abnormal

Document-themed campaign found in environments protected by Abnormal Security, Mimecast, and Microsoft ATP delivers MSP360 RMM via an embedded URL. MSP360 RMM delivers ConnectWise RAT.

Nike-spoofing, job application-themed emails found in environments protected by Abnormal Security,  Mimecast, and Microsoft ATP deliver an embedded link to a Nike-spoofing website that contains a Facebook-spoofing Credential Phishing page.

Document-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver an embedded link to a Microsoft-spoofing website that delivers a Credential Phishing site.

Finance-themed emails found in environments protected by Mimecast and Abnormal Security deliver MSP360 RMM via an embedded URL.

FIFA-spoofing, world cup-themed emails found in environments protected by Cisco IronPort, Abnormal Security, and Microsoft ATP deliver Voidrift via an embedded URL.

Taxes-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver a ConnectWise RAT via an embedded URL. Additional payload locations for ConnectWise RAT files were found during the course of this analysis.

Finance-themed emails found in environments protected by Abnormal Security, Cisco IronPort, and Microsoft ATP deliver Ninite Loader via an embedded URL.

Docusign-spoofing, document-themed emails found in environments protected by Microsoft ATP and Abnormal Security deliver SuperOps RMM via an embedded URL. SuperOps RMM delivers ConnectWise RAT.

Finance-themed emails found in environments protected by Abnormal Security deliver an embedded link to a Microsoft-spoofing OAuth 2.0-based credential phishing site.

SignWell-spoofing, document-themed emails found in environments protected by Abnormal Security and Microsoft ATP deliver an embedded link to a Credential Phishing site.

Invitation-themed emails found in environments protected by Abnormal Security and Microsoft ATP deliver an embedded link to a Microsoft Store-spoofing website that delivers a Google Meet-spoofing VBS file. When run, the script downloads and runs ConnectWise RAT.

Invitation-themed campaign found in environments protected by Microsoft ATP, Mimecast, and Abnormal Security delivers Tiflux RAT via an embedded URL. Tiflux RAT delivers an UltraVNC utility and Splashtop.