Summary:
In a recently observed campaign identified by the Cofense Phishing Defense Center (PDC) during an analysis of suspicious remote access activity, threat actors are weaponizing the trust associated with familiar brands like DocuSign, Adobe Sign, and Zoom Meeting. By utilizing sophisticated social engineering tactics and deceptive phishing emails, attackers trick victims into clicking redirect links that are multi-purpose: they can harvest credentials, facilitate OAuth token abuse for account compromise, or ultimately deploy the SimpleHelp RMM tool. Instead of being used for legitimate IT support, SimpleHelp is packaged within the Java-based JWrapper framework to function as a stealthy RAT. Because SimpleHelp is often deployed by legitimate IT teams, it has increasingly been co-opted by threat actors seeking persistent and long-term remote access across platforms that can blend in with normal network traffic to increase dwell time. This campaign underscores a growing trend of adversaries co-opting legitimate IT infrastructure tools and utilizing advanced obfuscation frameworks to bypass traditional endpoint defenses.

Security Officer Comments:
Attack Chain & Campaign Mechanics

• Initial Access: Victims receive phishing emails impersonating DocuSign, Adobe Sign, or Zoom (e.g., claiming a document is completed and prompting the user to "VIEW COMPLETED DOCUMENTS").
• Deceptive Redirection & Credential Theft: The embedded email buttons initially appear to point to legitimate Microsoft login pages but redirect the user to a malicious domain. Aside from malware delivery, this redirect infrastructure is designed to steal login credentials via fake Microsoft portals or perform OAuth token abuse for broader account compromise.
• Malicious Landing Page: The redirect sends the victim to a spoofed software portal, such as a fake "Adobe Document Portal," under the pretense of viewing a secure document. The payload URLs explicitly utilize fake Azure AD error strings to make the fake portals appear as authentic Microsoft authentication flows.
• Payload Delivery: The portal automatically downloads an executable disguised as legitimate software (e.g., Adobe.ClientSetup.exe).
• Execution & Installation: Once executed, the malicious software connects to an external URL (hxxps[://]klmgskmtn[.]com) to download specific JWrapper profiles. The use of JWrapper is highly strategic: it bundles the required Java Virtual Machine (JVM) and application files into a single cross-platform executable, ensuring the payload runs smoothly regardless of whether the victim has Java natively installed. This ultimately deploys SimpleHelp to the victim's machine.

The campaign analysis specifically mentions urging defenders to apply prompt updates for known vulnerabilities in targeted software like CVE-2024-57727 (SimpleHelp). The adversary exploits brand trust to lower victim defenses, using urgent document review lures and spoofed authentication error messages. The payload utilizes built-in command-line tools to ensure persistence and access. A winpty agent is included in the downloaded profile, which threat actors abuse to hide malicious code execution.

• netsh: Executed to create a new inbound firewall rule allowing incoming connections to SimpleHelp without being blocked.
• icacls: Executed to grant everyone full permission to all folders on the victim's file system, significantly expanding the attacker's operational capabilities on the host.

Suggested Corrections:

• Block Known Infrastructure: Immediately block access to the identified C2 IP (124[.]198[.]131[.]250) and payload domains (klmgskmtn[.]com, cli[.]re).
• Patch Vulnerabilities: Apply prompt updates for known vulnerabilities like CVE-2024-57727 as explicitly recommended in the campaign analysis.
• Monitor Command Line Activity: Create detection rules for suspicious netsh commands creating unapproved inbound firewall rules, and icacls commands attempting to grant sweeping folder permissions.
• Hunt for Unauthorized Tools: Scan endpoints for unexpected installations of the SimpleHelp RMM client or the presence of the JWrapper framework (including bundled JVMs), particularly if they are not approved IT tools for your organization.
• Detect Evasion Components: Monitor for unauthorized or abnormal execution of the winpty agent within system environments.

General Best Practices:

• Phishing Awareness Training: Educate users on identifying phishing red flags, specifically the dangers of hovering over links to verify the actual redirect destination versus the displayed URL. Emphasize that legitimate Microsoft login screens do not redirect to unfamiliar domains.
• OAuth Token Monitoring: Audit and monitor for abnormal OAuth token grants or suspicious application consent requests, as the redirect infrastructure facilitates this type of abuse.
• Remote Access Monitoring: Continuously monitor the network for unusual remote access activity or anomalous RMM tool deployments.

Link(s):
https://cofense.com/blog/brand-trust-as-a-weapon-multi-brand-impersonation-campaigns-deliver-jwrapper-malware