Vlad CherevkoI have been interested in various types of electronics and technology since the early 2000s. I love playing computer games and understand how different gadgets work. I regularly follow news from the world of technology and write articles about it myself.
12 October, 22:21
Researchers at Huntress have reported a new hacking campaign that used Microsoft’s Power BI platform to distribute malware for remote monitoring and control, TechRadar Pro reports.
According to the report, the attackers created public dashboards that mimicked blurred documents, emailed them to victims, and urged them to click a “Download Reference” button to open the full document. After clicking the link, victims were redirected to a website controlled by the attackers, where ScreenConnect monitoring and management software was automatically downloaded.
Example of a fake document link
Huntress
Microsoft Power BI is a business intelligence and data visualization service that lets you create charts, reports, and dashboards from various sources, such as spreadsheets, databases, cloud services, and more. In this case, the platform was used as a cover for a phishing attack. According to researchers, attackers may have used temporary or compromised Microsoft accounts to create the dashboards.
The “blurred document” method has long been used in phishing emails. Attackers have also used similar techniques through services such as DocuSign, Dropbox, and Office 365. Users were offered to “unlock” the document by downloading an updated version of the application or entering their credentials. In Power BI, clicking a button installed ScreenConnect.
The ScreenConnect application itself is not malicious. It is a legitimate tool from ConnectWise designed for remote support and device administration. It allows you to connect to computers, transfer files, and install software. However, in the hands of attackers, it can become a way to gain permanent access to corporate systems.
One feature of this attack was that after installing one instance of ScreenConnect, the hackers deployed a second instance and configured Windows tasks to regularly run a PowerShell script. Experts suggest that this approach gave the attackers persistent access to victims’ systems and made their activity harder to detect.
The researchers did not disclose how they delivered the emails, but because they contained links to a legitimate Microsoft service, they likely bypassed at least some email filters and reached users’ inboxes directly. This is likely why Power BI was used, as this service is rarely used for such attacks.
The hackers’ ultimate goals remain unknown. They could have included data theft, espionage, financial fraud, or ransomware deployment. All we know is that the dual use of ScreenConnect created a secure foothold in corporate networks.
Experts advise extra caution with emails containing links to “blocked” documents, because even legal services do not guarantee security.
MicrosoftCybersecurityHacker attacks
Advert:
Advert:
