{"id":23219,"date":"2026-09-22T11:16:00","date_gmt":"2026-09-22T11:16:00","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=23219"},"modified":"2026-09-22T11:24:24","modified_gmt":"2026-09-22T11:24:24","slug":"csuite-attack-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/csuite-attack-analysis\/","title":{"rendered":"CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access"},"content":{"rendered":"\n

ANY.RUN<\/a> researchers investigated CSuite<\/strong>, a phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and the abuse of legitimate management tools. The campaign showed a strong US focus, with 60% of identified victim organizations based in the United States<\/strong>. <\/p>\n\n\n\n

By blending trusted business services with legitimate remote-access software, CSuite can give attackers both account and endpoint access while making malicious activity harder to distinguish from normal workflows. <\/p>\n\n\n\n

Discover how the operation works, which tools and techniques it relies on, and what SOC teams should watch to detect related activity earlier. <\/p>\n\n\n\n

TL;DR <\/h2>\n\n\n\n
    \n
  • CSuite is a multi-stage phishing and remote-access operation targeting organizations across the US and Europe.<\/strong> Its campaigns use Adobe, DocuSign, Zoom, SharePoint, Microsoft 365 voicemail, and other trusted business themes to reach victims. <\/li>\n\n\n\n
  • The operation follows two main attack paths.<\/strong> One delivers legitimate remote-management and endpoint-management tools such as ScreenConnect, Action1, Atera, Syncro, and PDQ Connect. The other steals credentials and Microsoft 365 sessions through phishing and device-code authentication flows. <\/li>\n\n\n\n
  • US organizations make up the largest identified share.<\/strong> 60% of identified victim organizations were US-based, while 51% of sandbox submissions came from the United States. <\/li>\n\n\n\n
  • The campaign shows a significant scale.<\/strong> ANY.RUN identified 351 related sandbox analyses across 170 hosts, while the CSuite panel contained 216 unique Chameleon victims, 29 captured Microsoft 365 sessions, 1,593 lure documents, and 15,955 harvested email addresses. <\/li>\n\n\n\n
  • CSuite relies heavily on legitimate services and software.<\/strong> Hijacked Adobe Document Cloud tenants, Cloudflare Workers, public code hosting, and legitimate management tools help the operation blend malicious activity with normal business infrastructure. <\/li>\n\n\n\n
  • The strongest link between the campaigns is shared tooling and infrastructure.<\/strong> Delivery pages, phishing panels, domains, operator accounts, and exfiltration channels connect the remote-access and credential-theft activity to the same CSuite operation. <\/li>\n<\/ul>\n\n\n\n

    CSuite Threat Overview <\/h2>\n\n\n
    \n
    \"CSuite
    CSuite campaign in brief<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n

    CSuite creates risk on both the identity and endpoint sides of the environment. A single campaign can lead to stolen Microsoft 365 access, compromised mailboxes, or direct remote control of employee devices. <\/p>\n\n\n\n

    \n \n\n \n \n \n \n \n \n \n \n \n
    \n Attribute\u00a0 <\/th>\n \n Detail\u00a0 <\/th>\n <\/tr>\n
    \n Tracking name\u00a0 <\/td>\n \n CSuite, after the\u00a0CSuite\u00a0v1.1 panel at the\u00a0centre\u00a0of the operation\u00a0 <\/td>\n <\/tr>\n
    \n Structure\u00a0 <\/td>\n \n Infrastructure supplier with affiliates; the supplier hands out hosting, remote-desktop access and domains in private messaging channels, and each affiliate runs its own exfiltration endpoint\u00a0 <\/td>\n <\/tr>\n
    \n Motivation\u00a0 <\/td>\n \n Financial. Credential theft feeding manual mailbox access and business email compromise\u00a0 <\/td>\n <\/tr>\n
    \n Primary targets\u00a0 <\/td>\n \n Managed service providers, technology firms, government and administration, consulting, manufacturing, education and mortgage licensees, concentrated in the United States\u00a0 <\/td>\n <\/tr>\n
    \n Delivery\u00a0 <\/td>\n \n Adobe-themed download pages, plus\u00a0DocuSign, Zoom, Google Meet and Dropbox lure lines\u00a0 <\/td>\n <\/tr>\n
    \n Payloads\u00a0 <\/td>\n \n Legitimate remote-management and device-management agents deployed as RATs \u2014\u00a0ScreenConnect, Action1, Atera,\u00a0Syncro, PDQ Connect renamed to Adobe, Dotloop,\u00a0DocuSign\u00a0and others\u00a0 <\/td>\n <\/tr>\n
    \n Capture tooling\u00a0 <\/td>\n \n CSuite\u00a0v1.1 phishing panel with 23 modules, a\u00a0GSuitepanel, a per-affiliate worker view, an address validator, Cloudflare Worker proxies and a PHP\u00a0cloaker\u00a0 <\/td>\n <\/tr>\n
    \n Observed period\u00a0 <\/td>\n \n February 2026 to 3 September 2026; the kit path was still appearing in fresh sandbox analyses on the last day of collection\u00a0 <\/td>\n <\/tr>\n <\/table>\n<\/div>