Malware

PowerCat

Indicators of Compromise 10

Domain solthere[.]net Filename XenoIcon.jpg Filename decompiler.exe Filename xeno.exe Filename zoom-update.html GitHub Repo subscription-magnetic-recommended-meat.trycloudflare.com MD5 not specified SHA-256 not specified IP 207[.]174[.]0[.]143 IP 207[.]189[.]11[.]170

MITRE ATT&CK TTPs 13

Obfuscated Files or Information

Defense Evasion

Process Injection

Defense Evasion

Defense Evasion

Command And Control

Taint Shared Content

Lateral Movement

Command And Control

Ingress Tool Transfer

Command And Control

Exploitation for Client Execution

Trust Modification

Defense Evasion

Bypass User Account Control

Privilege Escalation

Source Articles

Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access

An active multi-wave campaign dubbed SMOKE#SCREEN by Securonix uses fake Adobe and Zoom update lures, along with business document themes, to deliver Remote Monitoring and Management (RMM) tools like ConnectWise ScreenConnect. The attack begins with spear-phishing emails containing obfuscated VBScript droppers that perform anti-analysis checks before deploying payloads. These payloads ultimately install ScreenConnect, providing attackers with persistent remote access through attacker-controlled relay servers. A separate but related campaign distributes the Powercat Java-based information stealer via fake Xeno Roblox cheat installers, enabling credential theft, surveillance, and remote control.

hacker-news ·4h ago