# When Trust Becomes a Trap: Foiling a Medical Software Hack

Attackers typosquatted MicroDicom's site to distribute a trojanized installer that installs OpenSSH and an UpdaterSvc.exe service, giving persistent SSH backdoor access to two medical orgs.

- Payout: Real-world hack
- Severity: high
- Program: MicroDicom
- Credited: Huntress
- Disclosed: 2024-07-23
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack
- Tags: domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:windows technique:recon technique:reverse-engineering vuln:misconfiguration vuln:secrets-leak

**Target:** Windows medical DICOM viewer installer / endpoint
**Root cause:** A cloned MicroDicom website (mlcrodlcom[.]info) served a 178MB trojanized installer signed by 'Helping Businesses Limited' that bundles OpenSSH and a persistent UpdaterSvc.exe service running 7655.bat to open an SSH tunnel to attacker infrastructure.
**Steps:**
1. Victim phished after CISA ICSMA-24-163-01 advisory, directed to typosquat `mlcrodlcom[.]info` (registered 2024-07-01)
2. Download page pulls installer from an S3 bucket named to resemble MicroDicom
3. Installer forks a dropped temp file that installs OpenSSH and registers `UpdaterSvc.exe` as an auto-start service
4. `UpdaterSvc.exe` runs `7655.bat` to establish an SSH tunnel to attacker server using bundled private keys
5. Multiple hosts connect to same SSH server with same username/keys
**How found:** Huntress SOC flagged anomalous SSH connections originating from a DICOM viewer installer; noted SSH to a raw IP rather than FQDN, installer absent from vendor site, and 178MB size vs ~13MB legitimate. Sandboxed dynamic analysis of both versions revealed bundled OpenSSH and UpdaterSvc.exe; browser history referrer and S3 bucket artifacts traced the download to the cloned site.
**Exploitation:** Social engineering around a real CISA advisory lures victims to a cloned site; the oversized installer drops OpenSSH plus a persistent service that opens an outbound SSH tunnel, giving attackers remote shell access to exfiltrate PHI/credentials or stage ransomware.
**Insight:** When a vendor advisory drops, monitor for lookalike domains registered in the following days and check endpoint browser-history referrers plus installer size/signer mismatches to catch trojanized 'patched' installers.