Rogue #ScreenConnect RMM cluster using a fake COLDCARD domain to lure crypto wallet owners 💰 into downloading a fake DocuSign MSI which drops ScreenConnect 🖱️🖥️ ⛓️ Attack Chain: Threat actor domain ➡️ GitHub repo ➡️ ScreenConnect 🔍 Fake #COLDCARD domain with opendir: hardware-data .com ➡️ Tucows Domains 🇺🇸 ⚙️ Rogue GitHub user with 19 code repositories: https://github.com/kaswareteam/ 🔌 ScreenConnect RMM botnet C2s (Port 8041 TCP): 🇺🇸 DeltaHost : hitpanels .com ➡️ 185.174.101.132 hitspanels .com ➡️ 185.174.101.132 🇺🇸 1337 Services GmbH: vicspanel .com ➡️ 155.2.192.94 hitstp .com ➡️ 155.2.192.235 vps133panel .com ➡️ 203.159.90.31 🦊 IOCs on ThreatFox: https://threatfox.abuse.ch/browse/tag/ScreenConnect/ 🏠 Payload delivery URLs on URLhaus: https://urlhaus.abuse.ch/browse/tag/screenconnect/