Dissecting a Weaponized Atera Installer: How a Fake Bank Statement Grants Full Remote Access

TL;DR

A file named eStatement915528860_pdf.msi — disguised as a bank statement PDF — is actually a legitimate, DigiCert-signed Atera RMM agent configured to register the victim’s machine with the threat actor’s Atera account. Once installed, the attacker gets persistent remote access including terminal, remote desktop (Splashtop), file transfer, and arbitrary code execution — all through Atera’s trusted commercial infrastructure.

The binary is not malicious by itself. The weaponization is in the configuration: the attacker’s encrypted account ID (RUu1oWoPdK97fGroQbluEhbPfbxoTsZowvAq/ZJcApU=) is baked into the MSI, enrolling every victim into their Atera tenant. Traditional AV will not flag this. C2 traffic flows through Azure, AWS IoT Core, and PubNub — all legitimate services.

At time of analysis (2026-04-07), this sample had zero detections on any public threat intelligence platform.

The Phishing Email

The attack begins with a phishing email impersonating the U.S. Social Security Administration:

The email body is a polished SSA impersonation asking the victim to “View My Statement” — which redirects through a tracking URL to the MSI download.

Sending Infrastructure

The attacker is abusing NetcoreCloud (Falconide), a legitimate Indian email marketing platform, to deliver the phishing emails:

The domain cuonlineedu.in is a combosquatting attack — it impersonates Chandigarh University’s online education portal (the legitimate domain is onlinecu.in). The attacker either compromised this domain or registered it specifically for this campaign.

Authentication: All Checks Pass

This is what makes the email dangerous — it passes every authentication check:

However, Microsoft’s anti-spam engine flagged it with SCL 8 (Spam Confidence Level — junk threshold is typically 5-6), routing it to the junk folder. The extensive ARA (Anti-spam Rule Agent) hits confirm Microsoft detected numerous suspicious signals.

The Click-Through Chain

Email "View My Statement" button
  → http://delivery.cuonlineedu.in/UDFEKT?id=28719=...
    → [redirect chain]
      → MSI download: eStatement915528860_pdf.msi

The tracking URL uses NetcoreCloud’s redirect infrastructure with a campaign ID of 28719 and Base64-encoded recipient tracking parameters.

The MSI Filename

eStatement915528860_pdf.msi

Three layers of deception:

1. “eStatement” — consistent with the SSA statement theme from the email
2. “915528860” — random digits mimicking a statement reference number
3. "_pdf" — tricks the victim into expecting a PDF document
4. ".msi" — the actual extension; a Windows Installer that executes with admin privileges

File Overview

The MSI contains a single payload — AteraAgent.exe (v2.5.9.0), a 21.1 MB self-contained .NET 8.0 PE64 executable.

Both the MSI and the embedded executable carry valid DigiCert code-signing certificates from Atera Networks Ltd. SmartScreen will trust it. Most endpoint protection will whitelist it.

Installation Kill Chain

When the victim double-clicks the MSI, the following happens silently:

Step 1: Pre-flight Checks

The installer verifies:

• 64-bit Windows (VersionNT64 check)
• Elevated/admin privileges (Privileged check)
• No existing Atera installation (upgrade/downgrade detection)
• .NET Framework 4.7.2 via registry (SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\Release)

Step 2: .NET Runtime Download

If .NET 8.0 isn’t present, the MSI downloads it via PowerShell:

1
2
3
4

powershell.exe -ExecutionPolicy Bypass -NoProfile -Command
  "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12;
   Invoke-WebRequest -Uri 'https://dot.net/v1/dotnet-install.ps1'
   -OutFile '[INSTALLFOLDER]dotnet-install.ps1'"

Followed by:

1
2
3
4

powershell.exe -ExecutionPolicy unrestricted -NoProfile
  -File "[INSTALLFOLDER]dotnet-install.ps1"
  -Channel 8.0 -Runtime dotnet
  -InstallDir "[INSTALLFOLDER]\.dotnet"

Step 3: Watchdog Disabled

1

schtasks /Change /TN "AteraAgentServiceWatchdog" /Disable

Step 4: Agent Registration (The Weaponization)

This is where the attacker’s configuration is injected:

1
2
3
4
5
6

AteraAgent.exe init-settings
  --agent-id "[AGENTID]"
  --account-id "[ACCOUNTID]"
  --environment "[ENVIRONMENT]"
  --customer-id "[CUSTOMERID]"
  --folder-id "[FOLDERID]"

The ACCOUNTID value — RUu1oWoPdK97fGroQbluEhbPfbxoTsZowvAq/ZJcApU= — is the attacker’s encrypted Atera tenant identifier. This single value enrolls the victim into the attacker’s control plane.

Step 5: Persistence

The agent installs as a Windows Service:

• Service Name: AteraAgentWindowsService
• Display Name: “Monitoring & Management Agent by ATERA”
• Start Type: Automatic (survives reboots)
• Install Path: C:\Program Files\ATERA Networks\AteraAgent\

C2 Architecture: Dual-Channel Through Legitimate Infrastructure

This is what makes RMM abuse so dangerous — the C2 is indistinguishable from legitimate traffic.

Primary: AWS IoT Core (MQTT over TLS)

The agent uses AWS IoT Core Fleet Provisioning to establish a mutually-authenticated MQTT channel:

1. Loads a bootstrap certificate from .certificates.bootstrap.<env>.bootstrap.cert.pfx
2. Connects to AWS IoT Core at a32dl55qcodech-ats.iot.eu-west-1.amazonaws.com (port 8883, mTLS)
3. Requests a device-specific certificate via $aws/certificates/create/json
4. Provisions using template atera-agent-provisioning-template
5. Subscribes to commands/<agent-id> for receiving commands

Library: MQTTnet 5.0.1.1416

Secondary: PubNub Real-Time Messaging

For presence detection and real-time events:

• Resolves pubsub.atera.com → pubsub.pubnub.com
• Library: PubnubPCL 6.20.2

HTTP API

The agent communicates with agent-api.atera.com (Azure West Europe, behind nginx + Azure Traffic Manager) for:

• Agent registration/heartbeat (/agentsapi/v1/Agent/starting, /pingMe)
• Settings sync (/settings)
• Command polling (/pendingCommands, /pollCommands)
• Error reporting (/logError)

Authentication is via custom HTTP headers:

X-Atera-AgentId: <GUID>
X-Atera-AccountId: <Base64-encoded encrypted ID>
X-Atera-AgentVersion: 2.5.9.0
X-Atera-OperatingSystem: Windows

Post-Compromise Capabilities

Once enrolled, the attacker has the full Atera RMM toolkit:

Commands received via MQTT are cryptographically signed (SHA-256). The agent verifies signatures before execution, though the error path suggests this may be a soft failure.

Infrastructure Map

Every single endpoint is legitimate Atera infrastructure. There is no attacker-controlled server to take down.

The Build-to-Sign Gap

MSI Build:    2026-03-12 09:53:38 UTC
MSI Signed:   2026-04-05 22:18:08 UTC
Gap:          24 days

The MSI was built on March 12 but signed on April 5. Since signing happens through Atera’s legitimate CI/CD pipeline (Azure DevOps, confirmed by the PDB path D:\a\1\s\installers\...), this suggests the attacker:

1. Generated the MSI from Atera’s web portal on March 12
2. Tested in staging for ~24 days
3. The MSI was signed when downloaded/finalized on April 5
4. Deployed in phishing campaigns immediately after

Attribution: Luna Moth / Silent Ransom Group

Luna Moth (also tracked as Silent Ransom Group) is known for:

• Callback phishing → RMM installation → data exfiltration → extortion
• Ransom demands between $1-8 million USD
• Using Atera, Syncro, SuperOps, Zoho Assist, AnyDesk, and Splashtop

MITRE ATT&CK Mapping

Indicators of Compromise

File Hashes

MSI SHA-256:  1df1888b8e29ad384c11d495d35b271d01ce3c2beabae6f1c5e043de81cbb1d1
MSI MD5:      1917eda341c77cb9e7ace89da08aef80
EXE SHA-256:  e84b45e34a5d2e0e51389439a2ea89ee761c462b081bc874d3aec2a90422f303
CA DLL SHA-256: 5b2c00e49882f41b1e804c3d461d42223f526be570cd465bc77eca7b86c254f3

Atera Account IOCs

EncryptedAccountId:  RUu1oWoPdK97fGroQbluEhbPfbxoTsZowvAq/ZJcApU=
Account Hex:         454bb5a16a0f74af7b7c6ae841b96e1216cf7dbc684ec668c2f02afd925c0295
ProductCode:         {02B8F4C8-95AE-4E8A-9902-545ABECA25E7}
UpgradeCode:         {18F64F52-CE08-434F-A5F1-7A8A39D59EEA}
ComponentGUID:       {07F21509-FD99-5748-A637-E765DA48CA52}

Phishing Infrastructure IOCs

Sending Domain:     cuonlineedu.in
Phishing URL:       delivery.cuonlineedu.in/UDFEKT
Sender IP:          175.158.66.164
SMTP Relay:         mta6-66.164.ptransmail.com
ESP:                NetcoreCloud / Falconide
MTA Source:         talentedgefal_28719
Campaign ID:        28719
DKIM Selectors:     nc2048 (cuonlineedu.in), fnc (env.etransmail.com)
Message-ID:         [email protected]

Host Indicators

Service:     AteraAgentWindowsService
Process:     AteraAgent.exe
Install Dir: C:\Program Files\ATERA Networks\AteraAgent\
Sched Task:  AteraAgentServiceWatchdog
Registry:    HKLM\SOFTWARE\ATERA Networks\AlphaAgent

YARA Rule

rule Atera_Malicious_Account_eStatement {
    meta:
        description = "Detects Atera MSI configured with known malicious account"
        author = "Animesh Roy"
        date = "2026-04-07"
        reference = "https://blogs.anir0y.in/"
    strings:
        $account = "RUu1oWoPdK97fGroQbluEhbPfbxoTsZowvAq/ZJcApU=" ascii wide
        $product = "{02B8F4C8-95AE-4E8A-9902-545ABECA25E7}" ascii wide
        $msi_magic = { D0 CF 11 E0 A1 B1 1A E1 }
    condition:
        $msi_magic at 0 and ($account or $product)
}

Detection Recommendations

For SOC/IR Teams

1. Hunt for the EncryptedAccountId RUu1oWoPdK97fGroQbluEhbPfbxoTsZowvAq/ZJcApU= across all endpoints
2. Search for unauthorized Atera installations — AteraAgentWindowsService where Atera isn’t approved
3. Block MSI ProductCode {02B8F4C8-95AE-4E8A-9902-545ABECA25E7} via AppLocker/WDAC
4. Monitor for AteraAgent.exe init-settings in process creation logs

For Email Security

5. Quarantine MSI attachments with filename patterns matching *Statement*_pdf.msi
6. Flag emails referencing eStatements that link to or attach MSI files

For Network Security

7. If your organization doesn’t use Atera, block *.atera.com at the proxy
8. Alert on MQTT connections to a32dl55qcodech-ats.iot.eu-west-1.amazonaws.com from unexpected endpoints
9. Flag PubNub traffic from endpoints not expected to use real-time messaging services

The Bigger Picture

This sample exemplifies why RMM abuse is one of the hardest threats to detect:

• The payload is 100% legitimate, commercially signed software
• C2 traffic flows through Azure, AWS, PubNub, and CloudFront — all trusted services
• The binary passes SmartScreen, AV signature checks, and application reputation systems
• The only “malicious” artifact is a 44-character Base64 string — the attacker’s account ID

The defense isn’t signature-based. It’s policy-based: if your organization doesn’t use Atera, no machine should be installing it. Application whitelisting, RMM tool auditing, and strict MSI installation policies are the effective countermeasures.

The attacker’s Achilles’ heel? That same 44-character string. Report it to Atera’s security team, and every agent enrolled to that account goes dark simultaneously.

The Bigger Picture

This sample exemplifies why RMM abuse is one of the hardest threats to detect:

• The payload is 100% legitimate, commercially signed software
• C2 traffic flows through Azure, AWS, PubNub, and CloudFront — all trusted services
• The phishing email passes SPF, DKIM, and DMARC via a compromised NetcoreCloud account
• The binary passes SmartScreen, AV signature checks, and application reputation systems
• The only “malicious” artifact is a 44-character Base64 string — the attacker’s account ID

The defense isn’t signature-based. It’s policy-based: if your organization doesn’t use Atera, no machine should be installing it. Application whitelisting, RMM tool auditing, and strict MSI installation policies are the effective countermeasures.

The attacker’s Achilles’ heel? That same 44-character string. Report it to Atera’s security team ([email protected]), and every agent enrolled to that account goes dark simultaneously.

References

• Luna Moth Callback Phishing — Unit 42
• Luna Moth Abuse Reamaze and RMM Tools — EclecticIQ
• SEO Poisoning: BATLOADER + Atera — Google Cloud
• Seedworm/MuddyWater Atera Campaign — Broadcom
• MuddyWater RMM Campaign — HarfangLab
• Atera Detection Techniques — Immersive Labs
• RMM Software Misuse — Intel 471
• Phishing Lures with RMM Tools — Red Canary
• Security at Atera — Atera Support
• Joe Sandbox Analysis — cuonlineedu.in phishing URL
• NetcoreCloud Server Exposed 40B Records — Hackread