US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries

[XploitLK-Bot]

A phishing campaign exploiting remote monitoring and management (RMM) software has expanded far beyond its initial targeting, with the United States now accounting for approximately 45% of all observed activity. The operation, which researchers at ANY.RUN initially linked to Canadian victims due to its use of Canada Revenue Agency (CRA) tax documents as lures, has been identified as part of a much larger effort spanning 46 countries.

• The United States is the primary target, representing nearly half of the campaign's activity.
• The campaign leverages tax-related documents to trick users into initiating malicious installations.
• The threat actors abuse legitimate RMM tools to gain remote access to compromised systems.

According to ANY.RUN's analysis, researchers connected 601 distinct cases to this broader global operation. The technique relies on social engineering to convince victims that they are installing necessary software, when in reality they are granting the attackers remote control capabilities. This method allows the threat actors to bypass traditional security measures by using trusted administrative tools for malicious purposes.

The shift in geographic focus highlights the adaptability of the threat actors, who adjusted their lures to match the target audience. While tax season remains a common vector, the success of this campaign depends on the inherent trust users place in branded documents and familiar software names.

Source: The Hacker News

Given that the U.S. is now the primary target, has your organization restricted or audited the use of RMM tools to prevent this type of abuse?