Date: 10/08/2026
Severity: High
Summary
In September, threat actors abused legitimate Power BI domains to make phishing emails appear trustworthy and evade security controls. Victims were directed to fake reference documents that prompted them to click “Download Reference,” leading to attacker-controlled websites. The sites fingerprinted victims before delivering a rogue ScreenConnect installer through a delayed, script-triggered download. Attackers deployed multiple rogue ScreenConnect clients to maintain persistent remote access and complicate removal. They also used a defense-evasion tool and scheduled tasks to further establish persistence and evade detection.
Indicators of Compromise (IOC) List
Domains/URLs | https://app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9 https://dailylifeproject.site/S/ https://burnsworth.site/S/main.html https://essaywritingservice.site/S/main.html https://openpediatrics.site/S/main.html https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE onthegotree.site instance-g01s1n-relay.screenconnect.com |
Hash | 5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3
f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "instance-g01s1n-relay.screenconnect.com" or url like "instance-g01s1n-relay.screenconnect.com" or siteurl like "instance-g01s1n-relay.screenconnect.com" or domainname like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO" or url like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO" or siteurl like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PERFECTO" or domainname like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN" or url like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN" or siteurl like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=ILEAYEASAN" or domainname like "onthegotree.site" or url like "onthegotree.site" or siteurl like "onthegotree.site" or domainname like "https://burnsworth.site/S/main.html" or url like "https://burnsworth.site/S/main.html" or siteurl like "https://burnsworth.site/S/main.html" or domainname like "https://essaywritingservice.site/S/main.html" or url like "https://essaywritingservice.site/S/main.html" or siteurl like "https://essaywritingservice.site/S/main.html" or domainname like "https://app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9" or url like "https://app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9" or siteurl like "https://app.powerbi.com/view?r=eyJrIjoiNTk0NmViNDktYzM1Yy00MjEwLTkyZTctNGU5ZTJmYzMzYjEwIiwidCI6IjU1YTI4YmU2LTFiYzQtNDIzMS05MTA0LTdkMmFlYTVmMGZhNiJ9" or domainname like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE" or url like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE" or siteurl like "https://hamham27.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&t=PAPASUPE" or domainname like "https://openpediatrics.site/S/main.html" or url like "https://openpediatrics.site/S/main.html" or siteurl like "https://openpediatrics.site/S/main.html" or domainname like "https://dailylifeproject.site/S/" or url like "https://dailylifeproject.site/S/" or siteurl like "https://dailylifeproject.site/S/" |
Detection Query 2 : | sha256hash IN ("5956f9afb3ba610c38b2cfda88dd15be98783963769a12020c93ce05e749b3c3","f048400c23add8c75abe189393d33c873c02c74eeaf43d47b950c8d643763b35")
|
Reference:
Microsoft Power BI to Deploy Rogue RMMs