{"id":22827,"date":"2026-08-25T10:40:19","date_gmt":"2026-08-25T10:40:19","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=22827"},"modified":"2026-08-25T12:36:11","modified_gmt":"2026-08-25T12:36:11","slug":"us-campaign-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/us-campaign-malware-analysis\/","title":{"rendered":"A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign"},"content":{"rendered":"\n

As ANY.RUN<\/a> analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States.<\/a> <\/p>\n\n\n\n

The attackers impersonate trusted organizations<\/a> and document types to trick victims into installing legitimate remote management software, giving them remote access to compromised systems. <\/p>\n\n\n\n

Part I. Campaign Scope, Impact, and Defense <\/h2>\n\n\n\n

Threat Overview <\/h3>\n\n\n\n
\"\"
Campaign overview based on ANY.RUN research<\/figcaption><\/figure>\n\n\n\n

This phishing operation\u2019s final goal is the remote control of the victim\u2019s machine. A reusable fake-document kit delivers interchangeable, legitimate RMM<\/a> software installer, which the attacker then abuses for hands-on access. <\/p>\n\n\n\n

Because the payload is signed commercial software, ordinary signature-based antivirus cannot flag it. Its activity resembles ordinary remote administration. <\/p>\n\n\n\n

View this malware analysis in TI Reports<\/a><\/p>\n\n\n\n

The campaign uses multiple lures, including the US Social Security Administration, Adobe PDF documents, invoices, VAT notices, and shipping communications, allowing the same attack model to target victims across different regions and business contexts. <\/p>\n\n\n\n

Campaign Profile<\/strong> <\/p>\n\n\n\n

\n \n\n \n \n \n \n \n \n \n \n \n
\n Attribute\u00a0 <\/th>\n \n Assessment\u00a0 <\/th>\n <\/tr>\n
\n Threat type\u00a0 <\/td>\n \n Phishing\u00a0delivering\u00a0RMM-as-RAT\u00a0for\u00a0living-off-the-land remote access\u00a0 <\/td>\n <\/tr>\n
\n Family\u00a0 <\/td>\n \n Fake-document-to-RMM\u00a0kit;\u00a0the\u00a0CRA\/T4 Word\u00a0lure\u00a0is one arm of a broader\u00a0fmtt\u00a0font-linked family\u00a0 <\/td>\n <\/tr>\n
\n Severity\u00a0 <\/td>\n \n High \u2014 hands-on-keyboard remote access\u00a0 <\/td>\n <\/tr>\n
\n Sophistication\u00a0 <\/td>\n \n Capable \u2014 kit-based delivery,\u00a0LOLBin\u00a0RMM\u00a0abuse, password-protected archive, Telegram-based victim filtering; built\u00a0entirely on legitimate signed tooling\u00a0 <\/td>\n <\/tr>\n
\n Payload\u00a0 <\/td>\n \n Signed\u00a0RMM\u00a0installers abused as remote-access trojans; productsare\u00a0interchangeable\u00a0and\u00a0include\u00a0GoTo\u00a0Resolve, LogMeIn\u00a0Rescue,\u00a0ITarian\u00a0in\u00a0this arm;\u00a0ScreenConnect, ConnectWise\u00a0in\u00a0sibling arms\u00a0 <\/td>\n <\/tr>\n
\n Impersonated brands\u00a0 <\/td>\n \n Canada Revenue Agency \/ 2025 T4 Form,\u00a0SSA, VAT\/ATO,\u00a0DocuSign, Adobe PDF, overdue\u00a0invoices,\u00a0shipping\u00a0documents\u00a0 <\/td>\n <\/tr>\n
\n Attribution\u00a0 <\/td>\n \n Campaign-level\u00a0based on shareddelivery-kit handwriting; no named threat actor.\u00a0Whether\u00a0this is\u00a0one operator or a shared phishing-as-a-service kit\u00a0remains\u00a0unknown\u00a0 <\/td>\n <\/tr>\n
\n Activity window\u00a0 <\/td>\n \n January 2026 to present; steady 17\u201333 kit cases per month\u00a0 <\/td>\n <\/tr>\n <\/table>\n<\/div>