- Threat actors are leveraging the holiday season by impersonating legitimate party invitation services like Punchbowl to distribute remote monitoring and management (RMM) tools
- Targeting US businesses predominately in the Finance, Professional Services (Accounting, Legal) and Real Estate industries
- Links within these fake invitations redirect users through Google Sites and HubSpot to download ScreenConnect RMM client software
Threat intelligence
Holiday Party Invitations Deliver Remote Access Tools
By Hiwot Mendahun, Ankit Gupta and the Mimecast Threat Research Team
Key Points
Campaign Overview
The Mimecast Threat Research team has identified an ongoing campaign exploiting the holiday season to distribute remote access tools disguised as holiday party invitations, with over 2,300 domains identified as targets primarily in the United States with notable concentration in Australia. This technique builds on established patterns of impersonation of legitimate invitation services such as Evite and Punchbowl to deliver both credential phishing pages and malware. The current campaign represents an evolution of this tactic, specifically targeting the increased volume of corporate holiday event communications.
Attack Flow
The attack begins with emails sent from legitimate but compromised business email accounts, lending immediate credibility to the message. These compromised accounts often belong to trusted third-party service providers such as accounting firms, legal practices, or business consultants. Recipients receive what appears to be a genuine invitation to a holiday party or holiday event. The email contains a link purporting to provide event details or RSVP options.
When clicked, the link initiates a multi-stage redirection chain designed to evade detection. In some campaigns we see users redirected through Google Sites or HubSpot's engagement service further obscuring the malicious destination. Other campagins we see a landing page which instructs the user to click on ‘Download File” button which will initate the download. The final landing pages host ScreenConnect RMM client installers masquerading as party invitation downloads.
Why RMM Tools Are Dangerous
Unlike traditional malware, ScreenConnect is a legitimate remote administration tool used by IT professionals for system management. However, when deployed by threat actors, it provides persistent remote access that often appears benign to security tools, particularly in mid-market organizations (500-5,000 employees) which often lack enterprise-grade detection capabilities. Once installed, attackers can:
