VENOMOUS HELPER / STAC6405 Dual RMM Phishing Campaign Targeting 80+ Organisations

VENOMOUS#HELPERSTAC6405ScreenConnectLogMeIn ResolveJWrapperdual-RMMphishingSSA impersonationPunchbowl lureEvite lureIRS lureRMM abuseInitial Access Brokerransomware precursorSafe Mode persistencewmic.exe.bakfinancially motivated

An active phishing campaign tracked by Securonix as VENOMOUS HELPER and overlapping with the Sophos cluster STAC6405 has been impersonating the U.S. Social Security Administration (SSA) and other lures - event invitations, tender invitations, and IRS forms - to deliver legitimate, vendor-signed Remote Monitoring and Management (RMM) software for silent persistent access. Securonix reports that more than 80 organisations have been impacted, predominantly in the United States, since at least April 2025.

Indicators of Compromise

Domains (4)

delicate-dew.serveftp.comexploit_siak_bahasa.pysystemd-update.serviceexfil_docs_v2.sh

Hashes (4)

974E272AD1DC7D5AADC3C7A48EC00EB201D04BA59EC5B0B17C2F8E9CD2F9C9CD734F0D04DC2683E19E629B8EC7F55349B5BCFF4EB4F2F36F6ADBBDE1C023A24F1CFEADF01D24182362887B7C5F683E8BDB0E84CDDCE03E3B7564B2D9AB5D15CF64674342041873DBB18B1DD9BB1CA391AF85B5E755DEFFB4C1612EF668349325

IPv4 (1)

95.111.250.175

Notes

<div style="line-height:1.2;margin-top:12pt;margin-bottom:6pt;">CONCLUSION</div> VENOMOUS#HELPER / STAC6405 is a textbook illustration of why signature-based detection alone has stopped being sufficient against modern initial-access operations. Every binary in the chain - SimpleHelp 5.0.1, ScreenConnect, LogMeIn Resolve - carries a valid Authenticode signature from a globally trusted CA. Antivirus sees nothing unusual, Windows SmartScreen and Mark-of-the-Web protections are bypassed by the certificates, and network controls see outbound traffic to commercial software endpoints rather than to known-malicious infrastructure.What remains visible is behaviour. Periodic SecurityCenter2 enumeration on a 67-second cadence, mouse-position polling, the creation of a 'Remote Access Service' Windows service with a SafeBoot persistence key, and the placement of wmic.exe.bak in the wbem directory are all artefacts that no legitimate IT use of SimpleHelp would produce. Defenders should anchor their detection strategy on those behaviours rather than on file hashes alone, because the operator can - and will - rotate file hashes, lure themes, and distribution domains.Strategically, the campaign should be treated as an Initial Access Broker storefront. The relatively low operator engagement after install, the broad sector targeting, and the dual-RMM redundancy together describe an access-as-a-service operation that monetises later through ransomware deployment, data theft, or onward sale. Critical controls for defenders: maintain a strict allow-list of approved RMM tools and enforce it through Application Control; restrict who can grant UAC approval; remove default browser credential storage in favour of passkeys or enterprise password managers; and treat the IOCs in this advisory as a starting point for retro-hunting in EDR, email gateway, and proxy logs. SOCRadar customers can leverage IOC Radar, Cyber Threat Intelligence, and Attack Surface Management to identify exposure to this activity at speed.<div> </div>

Mitigation

MITIGATION<a href="https://attack.mitre.org/">REF</a> <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#1f2a44;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;">Technique ID</th><th style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#1f2a44;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;">Technique Name</th><th style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#1f2a44;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;">Tactic</th><th style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#1f2a44;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;">Mitigation ID</th><th style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#1f2a44;padding:5pt 6pt 5pt 6pt;overflow:hidden;overflow-wrap:break-word;">Description</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1566.001</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Phishing: Spearphishing Attachment</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1049</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Antivirus / Antimalware - Deploy advanced email security with attachment sandboxing and URL detonation. Inspect file extensions before delivery and quarantine JWrapper-packaged executables masquerading as government documents.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1566.002</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Phishing: Spearphishing Link</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1017</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Training - Train users to spot SSA, Punchbowl/Evite, IRS-themed and tender-invitation lures. Encourage hover-before-click and reporting of links pointing to .com.mx or unfamiliar TLDs claiming to host U.S. government content.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1219</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Remote Access Software</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Command and Control</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1038</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention - Maintain a strict allowlist of approved RMM tools. Block unsanctioned RMM binaries (SimpleHelp, ScreenConnect, LogMeIn Resolve, Atera, PDQ Connect, ITarian) at the endpoint via Application Control or AppLocker.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1543.003</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Create or Modify System Process: Windows Service</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Persistence / Privilege Escalation</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1018</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Account Management - Restrict service-creation rights to admins only. Audit new services in C:\ProgramData\ subdirectories, especially services with the display name 'Remote Access Service'.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1562.009</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Impair Defenses: Safe Mode Boot</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1024</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Restrict Registry Permissions - Audit and restrict write access to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot. Alert on any new subkey created under SafeBoot\Network outside change windows.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1134.001</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Access Token Manipulation: Token Impersonation/Theft</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion / Privilege Escalation</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1026</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Privileged Account Management - Restrict SeDebugPrivilege to a small, audited group. Use Credential Guard and Protected Process Light (PPL) to harden winlogon.exe against token theft.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1548.002</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Abuse Elevation Control Mechanism: Bypass UAC</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Privilege Escalation</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1052</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Account Control - Set UAC to its highest enforcement level. Where possible, remove local-admin rights from end-user accounts so a UAC approval cannot grant SYSTEM-level access.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1518.001</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Software Discovery: Security Software Discovery</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Discovery</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1042</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Disable or Remove Feature or Program - Restrict use of WMI namespace root\SecurityCenter2 to administrators. Detect periodic enumeration of AntiVirusProduct, AntiSpywareProduct, and FirewallProduct from non-administrator processes.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1036.003</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Masquerading: Rename System Utilities</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1038</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Execution Prevention - Block executions where a process binary's filename does not match its embedded original filename. Specifically alert on wmic.exe.bak placed in C:\Windows\System32\wbem\.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1497.001</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Virtualization/Sandbox Evasion: System Checks</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1040</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Behavior Prevention on Endpoint - Use EDR behavioral rules that flag periodic mouse-position polling and idle-state probing - signals consistent with operator wait-for-idle techniques.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1027</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Obfuscated Files or Information</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1049</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Antivirus / Antimalware - Use static and dynamic analysis to inspect JWrapper-style installers. Decrypted hex-encoded launch properties and oversized PE overlays are useful triage signals.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1584.001</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Compromise Infrastructure: Domains</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Resource Development</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1031</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Network Intrusion Prevention - Filter traffic to newly-seen .com.mx, .top and .run.place domains, especially those serving Windows executables. Maintain DNS and proxy block lists for the campaign IOCs in this advisory.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1204.002</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Execution: Malicious File</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Execution</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1017</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">User Training - Educate users that valid Authenticode signatures (including 'SimpleHelp Ltd' and 'ConnectWise') do not by themselves indicate a safe executable. Files arriving via SSA/IRS/event-invitation themes should never be opened.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1573</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Encrypted Channel</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Command and Control</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1031</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Network Intrusion Prevention - Inspect outbound TLS to non-corporate cloud or commodity VPS providers (e.g., IONOS DE AS8560). Apply egress allowlists for endpoints that have no business reason to reach 213.136.71.246 or 84.200.205.233.</td></tr><tr style="height:0pt;"><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">T1555.003</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Credentials from Password Stores: Web Browsers</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Credential Access</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">M1027</td><td style="border-left:solid #efefef 0.5pt;border-right:solid #efefef 0.5pt;border-bottom:solid #efefef 0.5pt;border-top:solid #efefef 0.5pt;vertical-align:middle;background-color:#efefef;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Password Policies - Migrate users to passkeys or enterprise password managers, and disable browser-built-in credential storage in policy. This neutralises the infostealer secondary stage observed by Sophos.</td></tr></tbody></table></div>