screenconnect – Emiliano Carlesi's blog

The owner of pluks.org misconfigured his server. The whole domain is an “open directory” — a broken Apache autoindex that shows not just deployed phishing pages, but the operator’s entire toolkit neatly packaged in .zip archives. Downloading your own kit from your phishing site is a curious approach to OPSEC I can only commend, ironically.

What Matrix saw. Matrix flagged pluks.org within ~24h of registration (Hostinger NRD, 2025-08-25). Smith tagged it Opendir/opendirfiles/Threat/phishing/yahoo. Six distinct kits live on the server: credential phishing (generic webmail/Yahoo/Outlook/Gmail/AOL), a fake HR-interview portal, a “Secure Document” landing, and an invitation-themed AiTM kit. All of it exfiltrates to Telegram.

RMM abuse for initial access. The kits don’t drop a classic trojan. They install legitimate remote-management tools: ConnectWise ScreenConnect (repeatedly, via different social-engineering pretexts — “Zoom Timesheets”, “your device require screenconnect to access document”) and a Faronics Deploy Agent tucked inside 80 MB self-extracting “business documents” (PlauchevilleQuote_Reports_2.7.exe, DrillPoint_to_Point_RFPP91005643.exe, FiremasterRFP_Document.exe — the first two are byte-identical, differing only in lure name). Living-off-the-land RMM startup — an access vector most AVs happily tolerate.

Telegram everywhere. The primary bot (7692777141, chat 7791477575) is hard-coded across nearly every kit — a strong single-indicator pivot. The Invite/mvzoq kit raises the bar to AiTM-grade operation: a Telegram webhook + inline-keyboard console lets the operator steer each live victim session (“Yes Prompt”, “SMS Code I/II”, “Password Error”, “Block Visitor”, “Success”) as the phishing page polls for redirection instructions.

The ftx gate. The most sophisticated component is ftx/, a gated malware dropper: single-use HMAC-SHA256 tokens bound to victim IP+UA with a 5-minute TTL, header & cloud-provider blocks, and forced download via a fake-PDF swap. Non-Windows victims get shifted to a sibling domain, bucheinitiative.org — in Zefiro feeds since 2025-09-10, proving the actor has been operating for roughly a year.

And then I looked twice. My first analysis missed indicators: the open directory exposed a user-supplied extraction (Docusucess (2), sign (2)) that differed from the live folder, so I ran a complete, systematic IOC sweep. The second pass surfaced:

10 distinct Telegram bot tokens (each sign/*.html variant rotates its own token)
Operator identity: Telegram account @Hit_Big (id 914125722) driving the AiTM console with bot @Hitservices_bot; kit developer signature + Dev: @Blinkz455 +; anti-bot library of the $DheReckah$ family
Email-channel drops: PHPMailer configured against the actor’s own host anzservices.cupidjobs.com with plaintext password in the kit — drops w.space@yandex.com (active), emeraldadeh@gmail.com, abdulganiyutoyeeb@gmail.com, plus observer/bounce addresses xforgexxcoder22@gmail.com, olaideadebowale241@may.com
More actor domains: documentsfl.es, cmetn.org, wagni.org, bucheinitiative.org
ScreenConnect relay fleet (5): marlabs, aashay, dennisbasso, smiledon, stategraphic
Real victim credentials dumped by the webhook log (for victim notification, not blocklisting)
Preventive procedure: standardized full-extraction sweep — extract archives completely, run one regex sweep, classify: operator IOC / victim data / vendor noise

The preventive lesson: never analyze a kit by reading representative files. If each HTML variant rotates its own token, systematically sweeping with regex is the only way to be exhaustive (and to catch commented-out drops, which still count).

Indicators

All indicators are also published to the community feed: https://github.com/ecarlesi/ioc

Domains / hosts

Domain	Role
pluks.org	phishing kit hub (Hostinger NRD 2025-08-25)
bucheinitiative.org	dropper landing (actor since 2025-09-10)
wagni.org	asset host for install kit (NXDOMAIN now)
documentsfl.es	hard-coded redirect domain in sign redirector
cmetn.org	cloned-kit path host
anzservices.cupidjobs.com	SMTP relay (23.229.231.197) — SMTP creds in kit
marlabs.screenconnect.com	ScreenConnect relay #1 (15.204.108.177, OVH US)
aashay.screenconnect.com	ScreenConnect relay #2
dennisbasso.screenconnect.com	ScreenConnect relay #3 (104.45.153.136)
smiledon.screenconnect.com	ScreenConnect relay #4 (104.45.153.136)
stategraphic.screenconnect.com	ScreenConnect relay #5 (15.204.108.63, OVH US)

Telegram infrastructure

Indicator	Usage
`7692777141:AAF6gUupRhnjMqMgy0s5PQf599NvAiL6hgQ`	primary exfil bot (chat 7791477575) — main kits
`8052222881:AAGajAT_UBuUBuhTiBZTKGOij7xUmTSVJ3M`	install kit (chat 1750934376)

Email addresses (operator-controlled, not victim)

Email	Context
`resultbox14@gmail.com`	chr()-obfuscated drop in HR-portal kit (join)
`w.space@yandex.com`	active drop in AcrobatN mail.php
`emeraldadeh@gmail.com`	commented drop backup in mail.php
`abdulganiyutoyeeb@gmail.com`	commented cc/backup in mail.php
`xforgexxcoder22@gmail.com`	observer address hard-coded in Gmail clone
`olaideadebowale241@may.com`	bounce/From in OTP mailer
`noreply@anzservices.cupidjobs.com`	SMTP user (password `hidden`)

Binary hashes (SHA256)

SHA256	Note
`fa01bd4567d715af0fa6d751ca6a4d10bcc5f55e92ccd88faef50232f4c4025b`	Faronics Deploy Agent SFX — PlauchevilleQuote_Reports_2.7.exe == DrillPoint_to_Point_RFPP91005643.exe (same file, two lures)
`df559fea0016bea3c7c90eca5660ed4766bf65716de2f2883b79cadb2bbed8b6`	ScreenConnect.ClientSetup.exe (install kit)
`35bf578d49e1b5976e7faf431e794361836e30d267dd09012334e3ab8d4895c3`	FiremasterRFP_Document.exe
`8a61c7d9f9d297723e7ee8afe9bbebd277589a408c5be7834c79593ae21a800c`	ScreenConnect.ClientSetup.msi (HR portal kit)

Misc fingerprints

Indicator	Context
`One Mumu Don Press Am`	Nigerian-Pidgin victim-alert in exfil message (high-fidelity)
`party_5mjuaGEb_installer_.vbs`	VBS dropper name in kit config
`d6f3a6e2b8c94e87b735c1a2d47f5e78`	hard-coded AES-256/HMAC key of the ftx gate
`Visitor ID: ([a-f0-9]{64})`	visitor marker in Telegram webhook handlers
`DheReckahDeclineDisturbOne`	anti-bot library marker
`noreply@anzservices.cupidjobs.com`	SMTP sender

Victim data (for notification only — do NOT blocklist)

Email	Credentials in leak
`secure013a@gmail.com`	password `hidden`
`sjshshs@gmail.com`	password `hidden`
`michaelroy.investments@gmail.com`	password `hidden`

This article was generated with AI assistance (model: Kimi K3). All data from static analysis; no samples executed. Indicators are published to the community feed — researchers can request kit access via Matrix project.

Tag: screenconnect

The phishing site that leaked its own toolkit — and what happened when I looked twice