Malware Disguised as Video Files Using RMM Tools (Syncro, SuperOps, NinjaOne, etc)

Summary

Threat actors are using malicious PDF lures to funnel users to counterfeit Google Drive pages that advertise “video” downloads. Instead of media files, the sites deliver signed RMM installers—including tools such as Syncro, ScreenConnect, NinjaOne, and SuperOps—that provide attackers with reliable remote access and persistence on compromised endpoints.

Investigation

AhnLab observed PDF-based phishing activity leveraging filenames such as Invoice_Details.PDF and redirecting victims to domains like adobe-download-pdf.com or a lookalike drivegoogle.com portal. The delivered RMM installers were signed with a reused certificate and included installation parameters (for example, a key and customer ID) consistent with staged or automated deployments. The installers were produced using common packaging frameworks such as Advanced Installer or NSIS and, in some cases, acted as a bootstrapper to retrieve additional payloads after execution.

Mitigation

Limit or block execution of unauthorized RMM tooling, including binaries that are unsigned or unexpectedly signed, and enforce stronger controls for installing remote access software. Apply strict email attachment inspection to detect PDF lures and suspicious redirect behavior, and block known malicious domains at the gateway and proxy layers. Verify code-signing certificates and publisher details before permitting installation, keep approved RMM products patched, and restrict their use to explicitly authorized administrators.

Response

Alert when RMM installers execute from untrusted sources and when endpoints access the identified filenames, URLs, or redirect patterns. Isolate impacted hosts, collect installer artifacts and execution telemetry, and perform forensic triage to identify any secondary payloads downloaded post-install. Remove the rogue RMM agent, reset potentially exposed credentials, and expand hunting for related RMM deployment attempts across the environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Phishing Delivery: The adversary sends a spear‑phishing email with a malicious PDF titled “Invoice #12345.pdf”. The PDF contains a malicious JavaScript payload that, when opened, drops Syncro.exe into %TEMP%.

  2. Execution: The payload runs a PowerShell command to bypass execution policy and launch the binary:

     powershell -NoP -W Hidden -Exec Bypass -Command "Start-Process -FilePath "$env:TEMPSyncro.exe" -ArgumentList '/silent'"

  3. Resulting Telemetry: Windows records an Event ID 4688 with Image = C:Users<user>AppDataLocalTempSyncro.exe, matching the Sigma rule’s Image|endswith: 'Syncro.exe'. The alert is generated with High severity.

• Regression Test Script: The following script reproduces the exact behavior in a controlled lab environment. It copies a known RMM binary (for test purposes) to the temp directory and executes it with a benign flag, ensuring the same process‑creation event is emitted.

  # -------------------------------------------------
  # Simulation Script – Trigger RMM‑Tool Process Rule
  # -------------------------------------------------
  # Prerequisites:
  #   - A copy of Syncro.exe placed in C:Tools (legitimate binary for testing)
  #   - Administrative rights to write to %TEMP%
  # -------------------------------------------------
  
  $src  = "C:ToolsSyncro.exe"
  $dest = "$env:TEMPSyncro.exe"
  
  Write-Host "[*] Copying RMM binary to temporary location..."
  Copy-Item -Path $src -Destination $dest -Force
  
  Write-Host "[*] Executing the binary to generate process‑creation telemetry..."
  Start-Process -FilePath $dest -ArgumentList '/silent' -WindowStyle Hidden
  
  Write-Host "[+] Execution complete. Verify detection in SIEM."
  # -------------------------------------------------

• Cleanup Commands: Remove the test binary and terminate any lingering processes.

  # Terminate any stray Syncro processes
  Get-Process -Name "Syncro" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Delete the temporary copy
  Remove-Item -Path "$env:TEMPSyncro.exe" -Force -ErrorAction SilentlyContinue
  
  Write-Host "[*] Cleanup completed."