Deep Dive: Dual-RMM Phishing and PowerShell RAT Campaigns Targeting U.S. SLTTs
The cybersecurity landscape for State, Local, Tribal, and Territorial (SLTT) government entities in the United States continues to evolve, presenting an attractive target for sophisticated threat actors. Recently, the CIS CTI team identified an active and highly concerning phishing campaign specifically engineered to compromise U.S. SLTT organizations. This campaign distinguishes itself through the deployment of a custom PowerShell WebSocket Remote Access Trojan (RAT) alongside a strategic reliance on dual Remote Monitoring and Management (RMM) tools, significantly enhancing adversary persistence and operational redundancy.
The Initial Compromise: Phishing as the Primary Vector
As is often the case, the initial access vector for this campaign is meticulously crafted phishing. Threat actors leverage highly convincing social engineering tactics to trick unsuspecting SLTT employees into executing malicious payloads. These phishing lures typically impersonate legitimate entities or internal IT communications, often featuring urgent requests related to password resets, software updates, or critical invoice reviews. The ultimate goal is to entice the recipient to click a malicious link or open an attachment, which then initiates the infection chain.
Upon successful interaction, the victim's system is typically subjected to a multi-stage infection process. This often involves downloading a benign-looking document or script that, upon execution, retrieves the subsequent stages of the attack. This initial foothold is critical for the adversary to perform reconnaissance and establish a more persistent presence.
The Core of the Attack: Custom PowerShell WebSocket RAT
A hallmark of this campaign is the deployment of a custom PowerShell-based RAT. PowerShell, an integral component of Windows operating systems, is frequently abused by attackers due to its powerful scripting capabilities and its ability to operate filelessly, reducing forensic artifacts. What makes this particular RAT noteworthy is its utilization of WebSockets for Command and Control (C2) communication.
- WebSocket Advantage: WebSockets provide a full-duplex communication channel over a single TCP connection, often over standard HTTP/S ports (80/443). This makes C2 traffic blend more easily with legitimate web traffic, evading traditional firewall and proxy detections that primarily inspect HTTP requests.
- RAT Capabilities: Once established, this PowerShell RAT grants threat actors extensive control over the compromised system. Capabilities typically include:
- System information gathering (network configuration, installed software, user accounts).
- File manipulation (upload, download, deletion).
- Execution of arbitrary commands and scripts.
- Keylogging and screenshot capabilities.
- Persistence mechanisms (e.g., scheduled tasks, registry modifications).
- Lateral movement within the network.
The custom nature of the RAT also implies a higher level of sophistication and resources from the threat actor, making signature-based detection more challenging for conventional security solutions.
Strategic Redundancy: The Dual-RMM Approach
Perhaps the most concerning aspect of this campaign, beyond the custom RAT, is the observed use of dual RMM tools. Remote Monitoring and Management software, while legitimate and widely used by IT departments for system administration, is a favored tool for adversaries due to its inherent trust, robust remote access capabilities, and ability to bypass many security controls designed for traditional malware.
Threat actors deploy two different RMM solutions on compromised systems for several strategic reasons:
- Redundancy and Persistence: If one RMM tool is detected and removed, the other provides a fallback mechanism, ensuring continued access to the target network.
- Evasion: Different RMMs may have varying detection profiles. Using two increases the chances of at least one remaining undetected.
- Functionality: Adversaries may prefer specific features or stealth capabilities offered by different RMM platforms.
- Operational Flexibility: Maintaining multiple access paths provides greater agility in responding to defensive actions or network changes.
Commonly abused RMM tools include AnyDesk, TeamViewer, ConnectWise ScreenConnect, Atera, and NinjaOne. The deployment of two distinct RMMs on the same endpoint underscores the adversary's determination to maintain a persistent foothold within SLTT networks.
Implications for SLTTs and Mitigation Strategies
The targeting of SLTTs with such a sophisticated multi-pronged attack poses significant risks, including data exfiltration, service disruption, and potential for wider critical infrastructure compromise. Effective defense requires a multi-layered approach:
- Enhanced Phishing Awareness: Continuous and realistic security awareness training is paramount, emphasizing the identification of sophisticated phishing lures.
- Endpoint Detection and Response (EDR): Robust EDR solutions are critical for detecting anomalous PowerShell execution, suspicious network connections (especially WebSocket C2), and the unauthorized installation of RMM tools.
- Network Segmentation and Monitoring: Segmenting networks limits lateral movement, while continuous monitoring for unusual outbound connections and C2 patterns is vital.
- PowerShell Logging and Script Block Logging: Maximize PowerShell logging, including script block logging, to gain visibility into executed commands and detect malicious activity.
- Application Whitelisting/Control: Implement policies to restrict the execution of unauthorized applications and scripts, particularly for RMM tools.
- Multi-Factor Authentication (MFA): Enforce MFA across all services to mitigate credential compromise.
Digital Forensics, Threat Intelligence, and Attribution
Post-incident analysis and proactive threat intelligence are crucial for understanding the full scope of such campaigns. Digital forensic investigators must meticulously examine endpoints for artifacts of the PowerShell RAT, RMM installations, and C2 communication. Network forensics will focus on identifying WebSocket traffic patterns and destination IP addresses.
During post-breach analysis or proactive threat intelligence gathering, tools for comprehensive link telemetry become invaluable. For instance, services like iplogger.org can be leveraged in a controlled, ethical environment by researchers to collect advanced telemetry—including originating IP addresses, User-Agent strings, ISP details, and device fingerprints—from suspicious links or C2 callbacks. This granular data is crucial for enriching incident response efforts, mapping attacker infrastructure, and aiding in threat actor attribution by providing crucial insights into the adversary's operational security posture and geographic footprint. Metadata extraction from phishing emails and observed C2 domains also contributes significantly to threat actor profiling and infrastructure mapping.
Conclusion
The Dual-RMM Phishing and PowerShell RAT campaign targeting U.S. SLTTs represents a significant escalation in adversary tactics. The combination of sophisticated social engineering, a custom fileless RAT leveraging evasive C2, and the strategic deployment of redundant legitimate remote access tools demands heightened vigilance and a proactive, defense-in-depth security posture from all SLTT organizations. Collaborative intelligence sharing, as facilitated by entities like the CIS CTI, remains essential in combating these evolving threats.