Silent

Phishing: Spearphishing Link (T1566.002) via callback phishing dominated 2022 through early 2025 operations; fake invoices from Duolingo, MasterClass, and subscription services showing charges under one thousand dollars included obfuscated VoIP numbers reaching English-speaking call center operators.

March 2025 tactical shift to proactive vishing attacks; operators call law firm employees claiming to represent internal IT departments, asserting urgent overnight maintenance needs; victims directed to typosquatted domains like targetfirm-helpdesk[.]com registered through GoDaddy for remote access tool downloads.

SoftPerfect Network Scanner conducts network reconnaissance; SharpShares enumerates network shares via Network Share Discovery (T1135).

File and Directory Discovery (T1083) targets local drives and network-shared folders seeking legal communications for law firm victims, protected health information for healthcare targets, and financial records for financial services organizations.

Remote Access Software (T1219) deployment uses Zoho Assist as primary tool, supplemented by AnyDesk, Syncro, Splashtop, Atera, TeamViewer, ScreenConnect, and SuperOps; social engineering during callback phishing or vishing calls guides victims through voluntary installation posing as IT support.

Screen blanking features hide operator activities during active sessions; multiple redundant tools on single systems ensure continued access if defenders remove one application.

Masquerading (T1036) through IT staff impersonation and System Binary Proxy Execution (T1218) using signed legitimate software from Zoho, AnyDesk, Syncro, and similar vendors; all tools carry valid digital signatures bypassing antivirus and EDR validation.

Callback phishing creates victim-initiated contact appearing as legitimate IT support requests; screen blanking during RMM sessions hides operator activities from users at compromised workstations.

Minimal credential harvesting required as RMM tools operate within user security contexts granted during social engineering; Rclone and WinSCP credentials for exfiltration obtained through guided installation during initial access calls or extracted from browser password stores using remote access capabilities.

Zoho Assist, AnyDesk, and other RMM platforms provide encrypted communication channels for operator commands; legitimate remote access protocols blend with normal IT support traffic avoiding network monitoring alerts.

2022 campaigns used exfiltration servers on 192.236.128.0/17 network range with random five-letter .xyz domains; current operations since 2024 shifted to cloud storage services including Rclone synchronization and SFTP servers on Hostwinds hosting infrastructure.

Rapid pivot to data exfiltration minimizes lateral movement needs; SharpShares enumeration identifies accessible network shares for data collection using compromised user permissions rather than exploit-based propagation techniques.

WinSCP transfers data via SFTP (T1048) to attacker-controlled servers; Rclone synchronizes stolen files to cloud storage services (T1537).

WinSCP Portable executes on non-administrative accounts during initial callback phishing or vishing sessions; operators frequently rename Rclone executables to evade process monitoring; compression using 7-Zip or WinRAR before transfer with data volumes ranging from gigabytes to over one terabyte.

Syncro RMM installations provide persistence through registry modifications and scheduled tasks for extended access; multiple redundant RMM applications ensure continued access if defenders remove one tool.

March 2025 direct vishing campaigns often complete data exfiltration during initial remote access sessions without establishing long-term persistence mechanisms.

Systems remain operational during attacks as no encryption occurs, though stolen data remains in attacker possession creating permanent exposure risk regardless of victim response actions.

No encryption deployment; operates as pure data extortion without ransomware capabilities.

Financial Theft (T1657) through ransom emails arriving shortly after or before completing data exfiltration, threatening publication on leak sites, sale to competitors, or direct contact with victim's largest clients. Communications name specific high-value clients identified from stolen data.

Data leak sites including business-data-leaks[.]com operate on clearweb with victim names and countdown timers though inconsistent usage patterns create strategic uncertainty; post-payment behavior proves unreliable with documented cases where attackers ceased communication after receiving payments without providing proof of data deletion.

RMM tools including Zoho Assist, Syncro, and AnyDesk typically remain installed post-exfiltration; legitimate software usage generates normal system logs making forensic artifact removal unnecessary.