Research: Foreign criminal elements penetrate corporate networks in Israel

TrendAI researchers revealed that criminal elements from the Middle East are using legitimate remote management tools (RMM) to penetrate corporate networks in Israel. The attackers use malicious emails as bait (“Initial Access”), and from there they move on to the activation of innocent management tools that allow them full control over servers and endpoints without alerting classic defense systems. The attack is still active.

The attack targets organizations in Israel from all sectors, using the public tool screen connect and so far dozens of organizations have been attacked. According to the researchers, this is a low-sophisticated threat actor, but because it targets a wide range of organizations and because the attacked tools are defined as safe in most organizations, the attack manages to bypass traditional security barriers.

TrendAI researchers urge information security managers to proactively hunt for unusual RMM activity and impose strict restrictions on the use of these tools until further notice. This is an active event, and you must make sure that the systems in your organization are monitored and that access to these tools is limited to authorized persons only.

TrendAI recommends immediate steps for treatment. Monitoring: increasing control over remote management tools (such as ScreenConnect, TeamViewer, AnyDesk) and blocking installations/runs of unapproved versions or tools not in declared use.

Hardening: Enforce multi-factor authentication (MFA) on all remote connections, without exception.

Filtering: scanning for incoming emails containing links or files linking to these management tools, and blocking the IP addresses of the control servers (C2) of the tools if possible.

Review: Checking the authorization list in the corporate RMM to detect new users or devices that have not been defined by the IT team.