Attackers abuse Hexnode and Rippling MDM enrollment to persistently deploy ScreenConnect RMM via phishing

Linha do tempo

1. huntress.com ↗ · pub. 28/10/2026 13:00 · coletado 28/10 12:01 primeiro registro

   Attackers abuse Hexnode and Rippling MDM enrollment to persistently deploy ScreenConnect RMM via phishing

   ler a análise desta fonte ocultar

   Huntress reports several recent incidents in which threat actors weaponized legitimate mobile device management (MDM) platforms, specifically Hexnode and Rippling, to gain a trusted, privileged management path on victim Windows endpoints. This is abuse of legitimate functionality, not a vulnerability in either product. The intrusions start with business-themed phishing (fake DocuSign, proposal-review and Teams meeting lures) that tricks users into enrolling in an attacker-controlled MDM. The attackers then deploy unauthorized ScreenConnect RMM agents. Removing the RMM alone did not evict the actor in the Hexnode case, because the MDM enrollment let them reinstall ScreenConnect hours later.

   Technical Details

   • Hexnode case: Phishing emails with subjects such as "ATTN: Official Invitation to Submit Proposal" and "Review Required" linked to https://webdocusign.viewportal[.]es/Windows/download/index.php. This served eD0cuSign_Installer.msi, saved in the Microsoft Edge temporary downloads folder. It was a genuine Hexnode MDM package (Hexnode Gateway, Hexnode agent, PostgreSQL components) disguised as a DocuSign installer. ScreenConnect was installed shortly afterwards and connected to relay.bobdthjau[.]com:8041. The MSP removed it, but a second install reconnected to the same relay several hours later, triggering a second Huntress alert and endpoint isolation.
   • Rippling case: A receptionist received an email titled "Re: Tax Planning and Preparation Inquiry" with a link to a fake Teams scheduling page titled "Calendar" on teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com. It redirected to /teams/14/enroll14.php, which facilitated enrollment into an attacker-controlled Rippling MDM tenant. About a minute later a Rippling enrollment registry key appeared. The agent MSI was downloaded to C:\Windows\System32\config\systemprofile\AppData\Local\mdm\{GUID}.msi and installed as C:\Rippling\daemon.exe with SYSTEM privileges. About 35 minutes after installation, the attackers used the MDM to stage and run ScreenConnect as SYSTEM, connecting to relay.pronconetydesire[.]online:8041. Huntress concluded the attacker had previously created a Rippling account.
   • Detection logic: The stronger signal is the chain social engineering → new MDM enrollment → RMM installation → outbound connection to an unfamiliar relay, correlated across identity, MDM, endpoint and network telemetry.

   Remediation

   • Maintain an inventory of authorized MDM products, tenants, agents and RMM instances. Treat any unexpected enrollment, management agent or RMM instance as a security event.
   • Train users to verify unexpected meeting, document-signing and proposal-review requests. Apply email and web controls to business-themed lures.
   • If compromise is suspected: isolate the endpoint, remove it from the unauthorized MDM tenant, disable attacker-created accounts, revoke sessions and tokens, reset affected credentials, and reimage if integrity cannot be confirmed.