WhatsApp VBScript Campaign Installs ManageEngine RMM — Technical Guide

Researchers from Kaspersky have identified an active campaign where attackers distribute malicious VBScript files via WhatsApp. Unlike mobile-centric Phishing, this campaign specifically targets desktop environments. The malicious files are delivered as attachments that mimic legitimate documents. When executed, these scripts initiate a sequence that eventually installs ManageEngine’s Remote Monitoring and Management (RMM) software.

According to The Hacker News, the campaign has been observed in various regions including Brazil, India, and the U.K. This broad targeting suggests a generalized motivation, likely centered around financial gain or initial access brokering.

How to detect WhatsApp VBScript malware

Detecting these scripts requires monitoring for specific process behaviors. When a user clicks a malicious attachment in WhatsApp Desktop, the application spawns a host process (wscript.exe or cscript.exe) to interpret the VBScript. Defensive teams should look for anomalous child processes originating from the WhatsApp.exe process tree. Monitoring these execution chains is a primary method for how to detect WhatsApp VBScript malware before the final stage payload is deployed.

The use of legitimate RMM tools like ManageEngine is a sophisticated TTP designed to evade traditional EDR solutions. Because the software is legitimate and digitally signed, it often bypasses signature-based detection. This allows the attacker to establish a C2 channel that appears as normal administrative traffic to the SOC.

Technical Analysis of the Infection Chain

The infection starts with a message containing a seemingly harmless file name, often related to invoices or legal documents. However, the file extension is .vbs. Once the user runs the file, the script executes a series of commands to download and install the RMM agent. This process often includes modifying registry keys or scheduled tasks to ensure persistence.

The choice of ManageEngine RMM is notable. It provides extensive control over the victim’s machine, including file transfer, remote desktop access, and terminal execution. For an analyst, this means the attacker can perform Lateral Movement or deploy Ransomware with minimal additional effort.

ManageEngine RMM unauthorized installation detection

To mitigate this threat, organizations must implement strict software execution policies. Monitoring for the installation of unauthorized RMM tools is critical. If ManageEngine RMM appears on a workstation that is not managed by the IT department, it should be treated as a high-priority IoC. Effective ManageEngine RMM unauthorized installation detection relies on keeping an updated inventory of approved administrative tools and flagging any deviations.

Defenders should also consider the WhatsApp Desktop VBScript campaign analysis findings which highlight the vulnerability of users who rely on web-based or desktop messaging apps for business communication. By disabling the association of .vbs files with the Windows Script Host, many of these attacks can be neutralized at the point of execution.

Recommendations for Security Teams

• Implement Application Control: Use Windows AppLocker or similar tools to prevent the execution of scripts in user-writable directories like Downloads or Temp folders.
• User Education: Train employees to recognize that WhatsApp is an increasingly common vector for social engineering and that legitimate documents should not arrive as .vbs files.
• EDR Tuning: Configure EDR alerts to flag any instance of wscript.exe or cscript.exe communicating with external IP addresses, especially if the parent process is a browser or messaging app.
• Inventory Management: Maintain a strict list of authorized RMM tools and use SIEM rules to alert on any new RMM installations across the network.