Dual-RMM Phishing and PowerShell RAT Campaign Hits SLTTs

The CIS CTI team reports an active phishing campaign targeting U.S. SLTT organizations that uses legitimate-seeming Google Drive share notifications and GCS-hosted lure pages to deliver a PowerShell WebSocket RAT and subsequently install ScreenConnect and Pulseway RMMs for persistent, hands-on-keyboard access; four RAT variants were observed (including an upgraded variant with encrypted WebSocket C2, a true UAC bypass, and per-build payload randomization), and campaign infrastructure and payload hashes link the activity to a previously documented financially motivated cargo-theft/freight-fraud operation.