101010.pl

The New Oil<a href="https://mastodon.thenewoil.org/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> rotating code signing certificates over security concerns<a href="https://www.bleepingcomputer.com/news/security/connectwise-rotating-code-signing-certificates-over-security-concerns/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/connectwise-rotating-code-signing-certificates-over-security-concerns/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

Zeljka ZorzConnectWise is rotating code signing certificates. What happened?<a href="https://www.helpnetsecurity.com/2025/06/11/connectwise-is-rotating-code-signing-certificates-what-happened/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2025/06/11/connectwise-is-rotating-code-signing-certificates-what-happened/</a><a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/Connectwise" class="mention hashtag" rel="nofollow noopener" target="_blank">#Connectwise</a>

Andrew 🌻 Brandt 🐇What a wonderful thing to find out while on vacation that my phone is blowing up because a news article about <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> published yesterday (<a href="https://www.bleepingcomputer.com/news/security/connectwise-rotating-code-signing-certificates-over-security-concerns/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/connectwise-rotating-code-signing-certificates-over-security-concerns/</a>) referenced something I posted here in April (<a href="https://infosec.exchange/@threatresearch/114315246724920453" translate="no" rel="nofollow noopener" target="_blank">https://infosec.exchange/@threatresearch/114315246724920453</a>). (Thanks, Bill ❤️ & <a href="https://infosec.exchange/@BleepingComputer" class="u-url mention" rel="nofollow noopener" target="_blank">@BleepingComputer</a>)

The New Oil<a href="https://mastodon.thenewoil.org/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#CISA</a> warns of <a href="https://mastodon.thenewoil.org/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> <a href="https://mastodon.thenewoil.org/tags/ScreenConnect" class="mention hashtag" rel="nofollow noopener" target="_blank">#ScreenConnect</a> bug exploited in attacks<a href="https://www.bleepingcomputer.com/news/security/cisa-warns-of-connectwise-screenconnect-bug-exploited-in-attacks/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/cisa-warns-of-connectwise-screenconnect-bug-exploited-in-attacks/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> breached in cyberattack linked to nation-state hackers<a href="https://www.bleepingcomputer.com/news/security/connectwise-breached-in-cyberattack-linked-to-nation-state-hackers/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/connectwise-breached-in-cyberattack-linked-to-nation-state-hackers/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://mastodon.thenewoil.org/tags/DataBrach" class="mention hashtag" rel="nofollow noopener" target="_blank">#DataBrach</a>

Hackread.com⚠️ <a href="https://mstdn.social/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> RAT is the most popularly abused legitimate remote access tool and accounted for 56% of all active threat reports.Read: <a href="https://hackread.com/connectwise-screenconnect-tops-abused-rats-2025/" rel="nofollow noopener" translate="no" target="_blank">https://hackread.com/connectwise-screenconnect-tops-abused-rats-2025/</a><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> <a href="https://mstdn.social/tags/RAT" class="mention hashtag" rel="nofollow noopener" target="_blank">#RAT</a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Malware</a> <a href="https://mstdn.social/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#Scam</a> <a href="https://mstdn.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a>

Andrew 🌻 Brandt 🐇Last week I posted a thread about a <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> campaign delivering a <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> client as its payload. As of this morning, the threat actors have changed the payload (<a href="https://www.virustotal.com/gui/file/30e1d059262b851a2b432ec856aeba5bb639ba764aa85643703163d62000a2f4" rel="nofollow noopener" translate="no" target="_blank">https://www.virustotal.com/gui/file/30e1d059262b851a2b432ec856aeba5bb639ba764aa85643703163d62000a2f4</a>) and it appears to try to connect to the address "relay.noscreener[.]info" which resolves to 104.194.145.66.Embedded in the installer .msi file is a file called system.config, which contains this domain name and a base64-encoded string.The fake Social Security website is still being hosted on a compromised site that belongs to a temp agency based on the east coast of the US.Previous thread:<a href="https://infosec.exchange/@threatresearch/114315246724920453" translate="no" rel="nofollow noopener" target="_blank">https://infosec.exchange/@threatresearch/114315246724920453</a><a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#phishing</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a>

Andrew 🌻 Brandt 🐇However, because this attack has been going on for two weeks, some endpoint protection tools (well, about a third of them) are catching on that this particular file is bad, and should feel bad.<a href="https://www.virustotal.com/gui/file/13d71b884a0625f3aa3805fb779d95513d0485671ab8c090a0c790ceda071e63" rel="nofollow noopener" translate="no" target="_blank">https://www.virustotal.com/gui/file/13d71b884a0625f3aa3805fb779d95513d0485671ab8c090a0c790ceda071e63</a>The most important lesson here is that attackers always come up with new ways to evade detection. Using a commercially available, normally legitimate remote access tool with a valid cryptographic signature lets the attacker bypass some kinds of endpoint detection.Remember to check the From: address in emails, and the destination of any links they point to. You can do this by hovering your mouse over the link without clicking, and waiting a second. If it says it's from the SSA, but it isn't pointing to SSA.gov, then it's a lie. If you find content like this useful, please follow me here, or on LinkedIn: <a href="https://www.linkedin.com/in/andrew-brandt-9603682/" rel="nofollow noopener" translate="no" target="_blank">https://www.linkedin.com/in/andrew-brandt-9603682/</a>9/fin<a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a>

Andrew 🌻 Brandt 🐇When clicked, the button delivers malware, but it's an unexpected payload: A client installer for the commercial remote-access tool ConnectWise. Every time I clicked the download link, it gave me the same file with six different random digits appended to the filename. Note that it is not, as the website implies, a PDF document, but a Windows executable file, with a .exe extension.8/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a>

Andrew 🌻 Brandt 🐇This is where I tell you: don't do this! I am a trained professional. I click all the bad links so you don't have to. I am going to show you what happens next.A button appears on this page, labeled "Access Your Statement." The site serving up this payload delivers a file named "Social Security Statement Documents [six digit random number].exe"7/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇Finally the target lands on a page on the InMotion site that closely resembles the look-and-feel of the content in the email message. The page tells the visitor, in part "Download your statement as a PDF file" and "For security reasons, we recommend accessing your statement through your secure device."Spoiler alert: It was not a PDF file.(Edit: A reader informs me that this appears to be the hosting space used by the temp agency website, and that for whatever reason, the URL appears differently here.) 6/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇The target's browser then lands on another website, hosted by a large hosting service, InMotion Hosting. As with the temp agency website, the attackers have set up multiple URLs on this site, where the first URL performs a 302 redirect to go to the second URL, for no apparent reason other than to create the URL equivalent of a Rube Goldberg contraption.5/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇That link then immediately 302 redirects the target's browser to a link on a second website, one that belongs to a temp agency based in the US state of Maryland. The attackers have created two URLs on this company's site for this purpose. The first one redirects to the second one. Again, the site appears to have been compromised and used specifically for the purpose of obfuscating the redirection chain.4/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇The first 302 redirect points to a page on a website belonging to a small business that has, apparently, been compromised and abused for this purpose. 3/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇In this attack, the spammers have been sending emails that look like this official-appearing notification from the Social Security Administration. The message says "Your Social Security Statement is ready to review" and includes a button at the bottom labeled "Download Statement." The button links to a shortened URL that uses the link-shortening service t.ly to lead the target to a chain of 302 redirects. Malware spammers often do this to fool web reputation services and obfuscate the final destination of the link.2/<a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacks</a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>

Andrew 🌻 Brandt 🐇It sometimes pays to run domains that serve purely as spam honeypots. Case in point: A spammer has been delivering a ConnectWise commercial remote access client application as a payload in a scam that uses the purported arrival of a US Social Security statement as its hook.A 🧵 ...<a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#spam</a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener" target="_blank">#malspam</a> <a href="https://infosec.exchange/tags/attacksurface" class="mention hashtag" rel="nofollow noopener" target="_blank">#attacksurface</a> <a href="https://infosec.exchange/tags/SocialSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#SocialSecurity</a> <a href="https://infosec.exchange/tags/SocialSecurityAdministration" class="mention hashtag" rel="nofollow noopener" target="_blank">#SocialSecurityAdministration</a> <a href="https://infosec.exchange/tags/SSA" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSA</a> <a href="https://infosec.exchange/tags/usgov" class="mention hashtag" rel="nofollow noopener" target="_blank">#usgov</a>

JamesThis is probably only relevant to a *very* small number of people, but since I just spent all morning figuring it out…If you are trying to get <a href="https://vmst.io/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a> (remote screen-share tool) working on <a href="https://vmst.io/tags/Pop_OS" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pop_OS</a> <a href="https://vmst.io/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> and the shellscript installer is just failing silently, and the client never launches, try installing the "icedtea-netx" package.That seems to be installed on stock Ubuntu 22.04 desktop (or at least it was on my Ubuntu machines), but for whatever reason my Pop_OS machine didn't have it. With it installed, ConnectWise suddenly works. Magic!Glad CW supports Linux, but slight shade at having a setup script fail silently.

Sascha Stumpler<a href="https://hessen.social/tags/Connectwise" class="mention hashtag" rel="nofollow noopener" target="_blank">#Connectwise</a> <a href="https://hessen.social/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#PowerShell</a> Upload a file to Connectwise and Attach it to a Service Ticket with PowerShell <a href="http://dlvr.it/T7bqfk" rel="nofollow noopener" translate="no" target="_blank">http://dlvr.it/T7bqfk</a> via PlanetPowerShell

IT NewsRansomware associated with LockBit still spreading 2 days after server takedown - Enlarge (credit: Getty Images) Two days after an international... - <a href="https://arstechnica.com/?p=2005464" rel="nofollow noopener" translate="no" target="_blank">https://arstechnica.com/?p=2005464</a> <a href="https://schleuss.online/tags/screenconnect" class="mention hashtag" rel="nofollow noopener" target="_blank">#screenconnect</a> <a href="https://schleuss.online/tags/connectwise" class="mention hashtag" rel="nofollow noopener" target="_blank">#connectwise</a> <a href="https://schleuss.online/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#ransomware</a> <a href="https://schleuss.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://schleuss.online/tags/lockbit" class="mention hashtag" rel="nofollow noopener" target="_blank">#lockbit</a> <a href="https://schleuss.online/tags/biz" class="mention hashtag" rel="nofollow noopener" target="_blank">#biz</a>&it

Hambone FakenamingtonThe Fediverse and <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> has just helped me do my job better. Outsourced supplier has just asked me to install <a href="https://fosstodon.org/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener" target="_blank">#ConnectWise</a>. If it were not for the recent posts by <a href="https://fosstodon.org/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberSecurity</a> people on here; I wouldn't be aware of the recent issues so wouldn't be checking with the supplier that their ConnectWise setup is up to date!

Recent searches

Search options

Administered by:

Server stats:

#ConnectWise