← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
SEO Poisoning Attack Abuses Microsoft Signed Binary for RMM Tool Installation
SEO poisoning campaign has discovered impersonating legitimate open source data recovery tool named TestDisk. It silently installs ScreenConnect remote monitoring and management client to gain command execution, file transfer and lateral movement in the network.
Indicators of Compromise (7)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-SHA256 | 1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee5 | — | 2026-04-19 | |
| FileHash-SHA256 | 964843d2ac9fe0a7a7f568afd29dd712e8b2b44d6ac426d961ead5416d6f1999 | — | 2026-04-19 | |
| URL | http://www.testdisk.dev/download.html | — | 2026-04-19 | |
| domain | directdownload.icu | — | 2026-04-19 | |
| domain | testdisk.dev | — | 2026-04-19 | |
| hostname | direct-download.gleeze.com | — | 2026-04-19 | |
| hostname | www.testdisk.dev | — | 2026-04-19 |