Managed for Malice: How Attackers Turn MDM into Remote Access

What it is

Huntress reports two intrusions in which attackers enrolled victims in MDM tenants they controlled (Hexnode in one, Rippling in the other) and used the MDM to deploy ScreenConnect. The MDM clients are legitimate software. Huntress says neither vendor is at fault and no vulnerability is involved. The victims were socially engineered into enrolling.

How it works

flowchart LR
    A[Fake DocuSign MSI email] --> C[MDM enrollment]
    B[Fake Teams calendar link] --> C
    C --> D[ScreenConnect pushed as SYSTEM]
    D --> E[Attacker relay :8041]
    D -. removed by MSP .-> C
    C -. reinstalls .-> D

Hexnode case. Emails with subjects such as "ATTN: Official Invitation to Submit Proposal" and "Review Required" linked to https://webdocusign.viewportal[.]es/Windows/download/index.php. That link delivered eD0cuSign_Installer.msi to the Edge temporary downloads folder. The MSI installed Hexnode Gateway, the Hexnode agent and PostgreSQL components. ScreenConnect followed and connected to relay.bobdthjau[.]com:8041. The MSP removed it, and it came back several hours later to the same relay. Huntress then isolated the endpoint.

Rippling case. A receptionist received "Re: Tax Planning and Preparation Inquiry" with a link to a page titled "Calendar", hosted on teams-microsoftcom5d41402abc4b2a76b9719d911017c592.kiratham[.]com. A .php redirect appears to have enrolled the device in an attacker-controlled Rippling tenant. About a minute after the click, a Rippling enrollment registry key appeared. The agent MSI landed at C:\Windows\System32\config\systemprofile\AppData\Local\mdm\{GUID}.msi and installed as C:\Rippling\daemon.exe with SYSTEM rights. About 35 minutes later the MDM staged and ran ScreenConnect, connecting to relay.pronconetydesire[.]online:8041. Huntress concluded the attacker had created the Rippling account beforehand.

What to do

• Treat a repeat ScreenConnect alert as a sign of a surviving management channel. Check whether both installs used the same relay, and look for an MDM agent on the host.
• Keep an inventory of authorized MDM products, tenants, agents and RMM instances. Treat any unexpected enrollment, agent or RMM as a security event.
• Correlate identity, MDM, endpoint and network telemetry for this chain: social engineering, new MDM enrollment, RMM install, traffic to an unfamiliar relay.
• Hunt for the Rippling enrollment registry key, C:\Rippling\daemon.exe, Hexnode components installed from an MSI in a browser download folder, and the domains above.
• On suspected compromise: isolate the endpoint, remove it from the unauthorized MDM tenant, disable attacker-created accounts, revoke sessions and tokens, reset credentials, and reimage if integrity is uncertain.
• Train users to verify unexpected meeting, document-signing and proposal-review requests, and tighten email and web controls for business-themed lures.

Caveats

Hexnode and Rippling are examples, not a complete list of abusable MDMs. The Teams-themed site was taken down before analysis, so Huntress could not confirm its content or the exact enrollment step. The page names no registry key path or detection query, so those details are not available from it.