{
  "name": "Observed phishing URLs delivering RMM payload",
  "slug": "observed-phishing-urls-delivering-rmm-payload",
  "description": "ScreenConnect is used in phishing URLs to deliver RMM payload. DocuSign has been observed to be the common theme in these phishing emails.",
  "published": "2026-06-23T19:59:58.474000+00:00",
  "created_at": "2026-06-23T19:59:58.878000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-23T19:59:58.878000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "docusign",
    "phishing",
    "rmm",
    "screenconnect"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "31d80d0d-4151-47ab-ab38-6f96a939202f",
        "name": "https://vy.ijnggpi.com/ftx/"
      },
      {
        "id": "05fcfd2b-8a82-45cc-b474-e51ee8905620",
        "name": "a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b"
      },
      {
        "id": "f384a096-2fee-4ff3-99fd-743c4a930fe8",
        "name": "https://web-g63lkz.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi"
      }
    ],
    "attack_patterns": [
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      }
    ],
    "malware": [
      {
        "id": "b9a94179-fee8-4a2e-bcfb-ce9c0dd34433",
        "name": "ScreenConnect",
        "slug": "screenconnect"
      }
    ],
    "observables": [
      {
        "id": "dff531c7-67ad-4a37-9ce2-2a9552b87f0d",
        "name": "https://vy.ijnggpi.com/ftx/"
      },
      {
        "id": "fd950ee1-f5f8-426c-8f22-a321de9c8e57",
        "name": "https://web-g63lkz.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi"
      }
    ]
  },
  "external_refs": [
    {
      "id": "3b80bae2-6d41-4850-9180-a7147391118f",
      "standard_id": "external-reference--0061e04b-3859-5f12-95e7-667be1333f26",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3ae5bf02925732fd075068",
      "hash": null,
      "external_id": "6a3ae5bf02925732fd075068",
      "created": "2026-06-23T19:59:58.796Z",
      "modified": "2026-06-23T19:59:58.796Z",
      "createdById": null
    },
    {
      "id": "024f6aee-1fc1-4e20-aea0-68541c550bdd",
      "standard_id": "external-reference--5ad9c031-e7c0-58c7-92c7-b10ae466c7c1",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://x.com/patialavii/status/2068919332126835122",
      "hash": null,
      "external_id": null,
      "created": "2026-06-23T19:59:58.832Z",
      "modified": "2026-06-23T19:59:58.832Z",
      "createdById": null
    }
  ]
}