More RMM Tools In the Wild, (Tue, Oct 6th)

Threat actors are abusing the Action1 RMM tool to deliver malicious payloads. The attack begins with a phishing email containing a fake PDF invoice that redirects to a VBS file. This VBS file then downloads and installs an MSI archive containing files associated with the Action1 RMM tool, which installs itself as a service for persistence. The files are signed with an Action1 Corporation certificate. The threat actors are leveraging Action1's cloud infrastructure.