Dark Web Profile: Rock

SOCRadar profiles "Rock," a financially motivated developer behind "The Quarry" MaaS/PhaaS that supplies affiliates with a full phishing and remote-access toolset (modular PHP phishing kit, VBS droppers with UAC bypass, ScreenConnect RMM, mass-mailers, and post-exploitation scripts) used in tax-themed campaigns impersonating U.S. agencies; the ecosystem uses Adspect cloaking and Telegram for C2 and victim logging, has driven thousands of U.S.-focused downloads, and remains active as of May 2026.