On 2024-08-30, Blackpoint's MDR+R technology and Active SOC team stopped a threat actor attempting to use Greenshot within a Healthcare partner's environment.
Blackpoint's MDR+R technology identified an RDP connection from a public IP address from a user account of a Healthcare partner.
Initial investigation by the Active SOC found that the user accessed Dropbox and used the Greenshot tool, indicating a roughly even chance that the threat actor’s goal included exfiltration.
Additional analysis discovered that the threat actor utilized AnyDesk and TeamViewer on the host, coupled with additional suspicious network events in Netstat connected to Russian IP addresses.
Active SOC analysts isolated the affected device to prevent further malicious activity before reaching out to the Healthcare partner with additional details and remediation advice.