Andrew 🌻 Brandt 🐇<p>However, because this attack has been going on for two weeks, some endpoint protection tools (well, about a third of them) are catching on that this particular file is bad, and should feel bad.</p><p><a href="https://www.virustotal.com/gui/file/13d71b884a0625f3aa3805fb779d95513d0485671ab8c090a0c790ceda071e63" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">virustotal.com/gui/file/13d71b</span><span class="invisible">884a0625f3aa3805fb779d95513d0485671ab8c090a0c790ceda071e63</span></a></p><p>The most important lesson here is that attackers always come up with new ways to evade detection. Using a commercially available, normally legitimate remote access tool with a valid cryptographic signature lets the attacker bypass some kinds of endpoint detection.</p><p>Remember to check the From: address in emails, and the destination of any links they point to. You can do this by hovering your mouse over the link without clicking, and waiting a second. If it says it's from the SSA, but it isn't pointing to SSA.gov, then it's a lie. </p><p>If you find content like this useful, please follow me here, or on LinkedIn: <a href="https://www.linkedin.com/in/andrew-brandt-9603682/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">linkedin.com/in/andrew-brandt-</span><span class="invisible">9603682/</span></a></p><p>9/fin</p><p><a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>spam</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/malspam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malspam</span></a> <a href="https://infosec.exchange/tags/ConnectWise" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ConnectWise</span></a> <a href="https://infosec.exchange/tags/attacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>attacks</span></a></p>