Security researchers have identified a persistent operational shift where threat actors weaponize legitimate remote monitoring infrastructure. Documented by Xavier Mertens on the Sans Internet Storm Center, recent campaigns leverage deceptive phishing emails containing malicious PDF attachments to deploy an Action1 RMM tool without triggering standard endpoint alerts. Rather than embedding payloads directly inside the email body or utilizing macro-laden office documents, the campaign utilizes PDF files configured with specific structural triggers.
The PDF files contain an OpenAction directive combined with a Uniform Resource Identifier keyword. When a recipient opens the invoice document, the embedded action forces the PDF reader to query an external endpoint hosted on Vercel infrastructure. This vector bypasses standard text-based filters by keeping the email body free of suspicious URLs or executable attachments. Subsequent observations confirm that variations of this template substitute the VBS delivery with a ZIP archive containing an HTML Application script, yet both variants achieve identical drop behaviors.
Component Analysis and Code Signing of the Action1 RMM tool
The targeted URL retrieves an un-obfuscated VBS script designed to display a benign decoy PDF while executing secondary stages in the background. This script downloads an MSI package that houses components belonging to the legitimate Action1 RMM solution. Analysis of the extracted binaries confirms they carry valid signatures issued by Action1 Corporation under a certificate that expired in May 2026. Because these files originate from authorized administrative software, standard static file scans on platforms like VirusTotal often yield clean verdicts or low detection rates.
The MSI archive contains four distinct binaries:
- a1_7z_dll_file (SHA256: eaff35d250c9b04f51c971e70082740dbfeee5dd846829d541f588ad43378727)
- a1_sas_dll_file (SHA256: 996b01e15f85e165899630721a141b178a9c372b6e878012180ec9e9d4e7bd06)
- action1_remote_exe (SHA256: 1b19115d5ebdc216e0ab3adf2c643648cfc70a385f4caf0217c679f9f3b20342)
- main_service_exe (SHA256: 941695d20d82dd5d62f74b0111feb23720637202f6c797df2a02e2cb6cb6e8e3)
Persistence and Infrastructure Communication
Following execution, the Action1 RMM tool registers itself as a permanent system service. The installer establishes the A1Agent service, mapping execution directly to C:\Windows\Action1\action1_agent.exe. System registry inspection reveals persistent configuration parameters stored within the HKLM\Software\Action1\Agent hive, including specific values for the CustomerId, associated certificates, private keys, and local installation directories.
The hardcoded CustomerId value identified in captured samples connects outbound to the Action1 cloud infrastructure via server.na-2.action1.com. This behavior mirrors tradecraft documented in previous attacks involving tools like ScreenConnect, where operators register legitimate free or trial accounts on cloud-hosted remote management platforms to blend malicious persistence with routine administrative traffic.
Economic Incentives and Operational Risks
Cloud management platforms lower the operational cost for threat groups by offloading infrastructure maintenance, encryption enforcement, and connection stability to legitimate vendors. Attackers no longer need to provision custom command-and-control servers or maintain vulnerable infrastructure. Instead, they exploit the inherent trust placed in administrative tools by security software and system administrators alike. Unauthorized agents frequently evade detection because defenders prioritize operational uptime over strict baseline inventory enforcement across enterprise networks.
When legitimate utilities run as expected services, enterprise security teams face high false-positive rates if they block administrative software outright. Organizations that rely on automated provisioning risk overlooking unauthorized agents unless they explicitly inventory all active remote management installations against authorized procurement records. Attackers exploit this administrative blind spot by blending persistence mechanisms directly into standard enterprise tooling without triggering endpoint protection platforms configured to trust signed administrative utilities.
Detection Engineering and Remediation Guidance
Defenders investigating potential compromise indicators should audit endpoint logs for unexpected MSI installations originating from untrusted temporary paths, alongside registry modifications targeting the HKLM\Software\Action1 path. Network monitoring teams should inspect outbound traffic for connections to cloud management endpoints associated with Action1 infrastructure, particularly when initiated from workstations or servers lacking a corresponding corporate deployment of the agent. Restricting PDF readers from executing external URIs via Group Policy provides an effective preventive control against the initial document-based redirection vector.
Additional telemetry rules should focus on process lineage anomalies, specifically identifying instances where script interpreters such as wscript.exe or mshta.exe spawn child processes related to package installers or unknown network sockets. Security engineering teams can also implement software restriction policies to block execution of signed binaries that feature expired certificates or lack explicit inclusion in internal application control allowlists. Monitoring these specific validation failures helps isolate unauthorized administrative tool deployments before threat actors establish steady-state access within the affected environment.
Related coverage
- North Korean Actors Deploy Malicious Terraform Providers to Distribute Go Malware via HashiCorp Registry
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns
- Cisco 0-Day Vulnerability Exposes Users to Remote Exploitation