Skip to Content

Joint Warning from CISA, NSA, and MS-ISAC on Remote Monitoring and Management Software

In a joint cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) warn that threat actors used legitimate remote monitoring and management software to gain access to the networks of multiple federal civilian executive branch agencies. The advisory includes technical details, indicators of compromise, and recommended mitigations.

Cyber criminal actors have sent help desk-themed phishing emails to FCEB federal staff’s personal, and government email addresses.

Note

  • This is even more difficult to detect if the attacker does not install any new software, but uses existing remote control software on the host. Access to these tools needs to be monitored. Make sure you are not instrumenting your network with “attack tools”. This also reminds me a bit of the old days when attackers used console servers to bypass organization’s perimeter security stacks.
  • A few years ago in the SANS annual threat report, SANS highlighted “Living Off the Land” attacks where both OS capabilities (like remote desktop) and installed software tools were used by bad guys to facilitate attacks and evade detection. The campaign discussed is a good illustration and a good one to use in security awareness material – there are lot of chances for a user to say, “wait a minute…” and click X in the upper right corner – and, ideally, report a phishing attempt to security using the convenient menu bar item you have provided for them.
  • I have a person I work with in their 70s that fell for a phishing scam using RMM like this on their iPhone. The first alarming part I found is that AnyDesk could be used on an iPhone, which I had no idea was a thing. The second part of that conversation was that they fell for it because, according to them (unconfirmed), Apple support also used AnyDesk a few weeks before to troubleshoot their device. That felt a bit alarming. Be very careful to explain to friends and family that internet-based remote control is dangerous.
  • The CISA article includes IOCs for your threat hunters to follow up on. Yes, this is a social engineering attack, tricking users into installing remote management software and a refund scam to get access to user’s systems and bank accounts. You should be checking for installations of any remote management software. Take this scenario to your training team to make sure they have this type of social engineering covered, and that people are training regularly. Remember, after 4-6 months, retention fades.
  • A slightly different spin on Living off the Land Attacks. It starts first with a specially crafted phishing/smishing/vishing message that lures the unsuspecting victim to visit a malicious domain. While user training on phishing attacks is now part of annual security awareness training, some attacks will still get through. Proper configuration, patch, and network management are still highly important to limit attacker success.

Read more in

Alex Lim is a certified IT Technical Support Architect with over 15 years of experience in designing, implementing, and troubleshooting complex IT systems and networks. He has worked for leading IT companies, such as Microsoft, IBM, and Cisco, providing technical support and solutions to clients across various industries and sectors. Alex has a bachelor’s degree in computer science from the National University of Singapore and a master’s degree in information security from the Massachusetts Institute of Technology. He is also the author of several best-selling books on IT technical support, such as The IT Technical Support Handbook and Troubleshooting IT Systems and Networks. Alex lives in Bandar, Johore, Malaysia with his wife and two chilrdren. You can reach him at [email protected] or follow him on Website | Twitter | Facebook

    Ads Blocker Image Powered by Code Help Pro

    Your Support Matters...

    We run an independent site that is committed to delivering valuable content, but it comes with its challenges. Many of our readers use ad blockers, causing our advertising revenue to decline. Unlike some websites, we have not implemented paywalls to restrict access. Your support can make a significant difference. If you find this website useful and choose to support us, it would greatly secure our future. We appreciate your help. If you are currently using an ad blocker, please consider disabling it for our site. Thank you for your understanding and support.