CISA Alert: Scammers are Now Using Legitimate Remote Access Software to Trick You and Steal Your Money

CISA Alert: Scammers are Now Using Legitimate Remote Access Software to Trick You and Steal Your Money

PLEASE THINK BEFORE YOU CLICK!

Remote access software is common, legitimate, and useful software. Among other things, remote access software allows remote tech support so that legitimate companies (like ours) can help others remotely. 

But like most useful tools it can be misused. For instance, a hammer can be used as a bludgeon.

It seems scammers have found yet another way to steal your money using legitimate remote access software (also called “Remote monitoring and management (RMM) software).

Scammers are sending out ConnectWise Controlphishing emails with download links to legitimate remote-access software apps (usually ScreenConnect/ConnectWise Control or AnyDesk). Once the software is installed, scammers can take over your computer, and thus gain access to your banking and credit card accounts.

THINK BEFORE YOU CLICK!

And this serves as a reminder to us to remind you to THINK BEFORE YOU CLICK. Never click links in emails unless you are certain you know who sent them. Clicking links in phishing emails is the number one way people get their passwords and identities stolen. Once a crook has your passwords, logins, and other sensitive personal information, he/she can easily steal your money.

So, please, THINK BEFORE YOU CLICK

Here is the CISA/NSA Alert.

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and management (RMM) software. In October 2022, CISA identified a widespread cyber campaign involving the malicious use of legitimate RMM software. Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software—ScreenConnect (now ConnectWise Control) and AnyDesk—which the actors used in a refund scam to steal money from victim bank accounts.

Although this campaign appears financially motivated, the authoring organizations assess it could lead to additional types of malicious activity. For example, the actors could sell victim account access to other cyber criminal or advanced persistent threat (APT) actors. This campaign highlights the threat of malicious cyber activity associated with legitimate RMM software: after gaining access to the target network via phishing or other techniques, malicious cyber actors—from cybercriminals to nation-state-sponsored APTs—are known to use legitimate RMM software as a backdoor for persistence and/or command and control (C2).

Using portable executables of RMM software provides a way for actors to establish local user access without the need for administrative privilege and full software installation—effectively bypassing common software controls and risk management assumptions.

The authoring organizations strongly encourage network defenders to review the Indicators of Compromise (IOCs) and Mitigations sections in this CSA and apply the recommendations to protect against malicious use of legitimate RMM software.

Source:  CISA website.