SEO Poisoning Strikes Again: How a Fake TestDisk Site Uses DLL Sideloading to Deploy ScreenConnect RMM + Video

By /

Listen to this Post

Featured Image

Introduction

Search Engine Optimization (SEO) poisoning manipulates search rankings to push malicious websites above legitimate ones, tricking users into downloading trojanized software. In a recent campaign uncovered by Palo Alto Networks Unit 42, attackers created a convincing fake TestDisk site (testdisk.dev) that delivers a sideloaded Microsoft binary and installs ScreenConnect, a legitimate remote monitoring and management (RMM) tool, to gain persistent initial access. This technique abuses trust in signed Microsoft executables and turns a useful recovery tool into a stealthy backdoor.

Learning Objectives

  • Identify SEO poisoning red flags in search results and distinguish legitimate software sources from malicious clones.
  • Analyze DLL sideloading attacks using Windows event logs, process monitoring, and binary analysis tools.
  • Implement detection and mitigation strategies against RMM tool abuse for unauthorized remote access.

You Should Know

  1. Anatomy of the Attack: From Search Result to Sideloaded Payload

Attackers registered the domain `testdisk.dev` and optimized it to rank high for “TestDisk download.” The fake homepage mimics the legitimate open-source data recovery tool but serves a trojanized installer. Upon execution, the installer drops a legitimate Microsoft-signed binary (e.g., `MsMpEng.exe` or similar) and a malicious DLL that the binary sideloads due to DLL search order hijacking. The sideloaded DLL then executes `ScreenConnect.Client.exe` to establish a remote connection to the attacker’s server.

Step‑by‑step breakdown:

  1. User searches for “TestDisk download” and clicks the sponsored or top-ranked result testdisk.dev.

2. Download `testdisk-setup.exe` (hash differs from official version).

  1. Installer extracts files to `%ProgramData%\TestDisk\` or a temporary folder.
  2. Legitimate Microsoft executable (signed) is placed alongside a malicious DLL with a name expected by that executable (e.g., version.dll, winhttp.dll).
  3. When the Microsoft binary runs, Windows loads the adjacent malicious DLL instead of the system version.
  4. The DLL’s `DllMain` or exported function calls `ScreenConnect.Client.exe` with preconfigured connection parameters.
  5. ScreenConnect establishes outbound HTTPS tunnel to attacker’s C2, granting remote desktop and command execution.

Windows commands to detect suspicious sideloading:

 Monitor process creation with DLL loads (run as Admin)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=7} | Where-Object {$_.Message -match "ImageLoaded.\\TestDisk"}

List running processes and their loaded DLLs
tasklist /m /fi "imagename eq MsMpEng.exe"

Check for unsigned or unexpected DLLs in trusted binary directories
Get-ChildItem -Path "C:\ProgramData\TestDisk" -Recurse -Filter .dll | Get-AuthenticodeSignature

Linux alternative (for analyzing Windows samples via Wine or FlareVM):

 Use pescan to check DLL imports and sideloading candidates
pescan --dll --imports suspicious_binary.exe

Monitor file system changes during installer execution (using inotify)
inotifywait -m -r /path/to/extracted/files -e create,modify

2. Detecting RMM Tool Abuse in Your Environment

ScreenConnect (now ConnectWise Control) is a legitimate RMM used by IT teams. Attackers install it silently to maintain persistence without triggering traditional antivirus. The trojanized installer often configures ScreenConnect as a service with a custom access key or uses the free tier’s default settings. Defenders must monitor for unauthorized RMM instances.

Step‑by‑step detection and hardening:

  1. Inventory authorized RMM tools: Maintain an allowlist of approved remote access software and their installation paths.

2. Monitor service creation events:

  • Event ID 7045 (Service installed) in System log.
  • Look for ScreenConnect Client, ScreenConnect Service, or similar names.
  1. Analyze network connections: ScreenConnect uses outbound HTTPS on port 8041 or 443. Detect connections to unknown domains or IPs associated with attacker C2.
  2. Check for silent installation indicators: ScreenConnect installer can run with `/quiet` or `/silent` flags. Look for command-line arguments in Event ID 4688 (Process creation) containing ScreenConnect_Setup.exe /quiet /install.

PowerShell detection script:

 Find ScreenConnect processes and services
Get-Process -Name "ScreenConnect" -ErrorAction SilentlyContinue
Get-Service | Where-Object {$_.DisplayName -like "ScreenConnect"}

Extract service binary path and check digital signatures
$svc = Get-WmiObject Win32_Service | Where-Object {$_.Name -like "ScreenConnect"}
if ($svc) {
$binPath = $svc.PathName -replace '"',''
Get-AuthenticodeSignature $binPath
 Compare hash with known good version
Get-FileHash $binPath -Algorithm SHA256
}

Linux-based network detection (Zeek/Suricata):

 Zeek signature to detect ScreenConnect default JA3 hash
echo 'signature screenconnect-ja3 {
ip-proto == tcp
tcp.dport == 443
ja3_hash == "e7d705a808e6b1e7a6a93c94fc8e9af0"  Example hash, update from threat intel
event "SCREENCONNECT_DETECTED"
}' | tee /etc/zeek/sigs/screenconnect.sig

3. SEO Poisoning Triage for Security Analysts

Attackers manipulate search engine rankings using cloaking, backlinks, and keyword stuffing. When investigating a potential SEO poisoning incident, analysts must compare search results, SSL certificates, and domain registration details.

Step‑by‑step investigation workflow:

  1. Extract the malicious URL from alerts (e.g., testdisk.dev). Use `whois` to check registration date – fresh domains (<30 days) are suspicious.
  2. Fetch the page with curl to examine server-side cloaking: 
    curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -L http://testdisk.dev -o fake-site.html
grep -i "download|installer|exe" fake-site.html
  3. Compare file hashes between official and fake installer: 
    Official TestDisk hash (example)
(Get-FileHash C:\Downloads\testdisk-7.2-win64.exe).Hash
Compare with downloaded sample
(Get-FileHash C:\Downloads\testdisk-setup.exe).Hash

    4. Analyze the trojanized installer with static tools:

    Extract resources and strings
strings -n 8 testdisk-setup.exe | grep -i "screenconnect|http|dll"
Check for embedded executables
binwalk -e testdisk-setup.exe
  4. Submit to sandboxes like Joe Sandbox or ANY.RUN with Windows 10+ environment to observe DLL sideloading behavior.

Mitigation for organizations:

  • Implement DNS filtering to block newly registered domains (NRDs) for 30 days.
  • Use browser extension or proxy to alert users when search results point to domains with low reputation.
  • Deploy endpoint detection rules for DLL sideloading patterns: a signed Microsoft executable loading an unsigned DLL from its working directory.

4. Hardening Against RMM Backdoor Persistence

Once ScreenConnect is installed, attackers can create user accounts, disable security tools, and exfiltrate data. Proactive hardening prevents unauthorized RMM usage even if an installer executes.

Step‑by‑step hardening guide:

1. Restrict RMM installation via Group Policy (Windows):

  • Apply Software Restriction Policies or AppLocker to block execution of `ScreenConnect_Setup.exe` unless digitally signed by ConnectWise AND deployed from a trusted installer path.
  • Example AppLocker rule (PowerShell): 
    $rule = New-AppLockerPolicy -RuleType Exe -User Everyone -Path "%ProgramFiles%\ScreenConnect\" -Action Allow
Set-AppLockerPolicy -Policy $rule -Merge

2. Monitor and alert on RMM service start/stop:

  • Create a Windows Event Collector subscription for Event ID 7036 (Service status change) with filter for ScreenConnect.
  1. Network segmentation: Place all workstations in a VLAN that cannot initiate outbound RDP or remote control sessions without explicit proxy authentication.
  2. Enable RMM detection in EDR: Configure your EDR (e.g., CrowdStrike, SentinelOne) to flag ScreenConnect installations not matching your deployment script hash.
  3. Linux cloud hardening (if using ScreenConnect agents on servers): 
    Block outbound ports used by RMMs via iptables
iptables -A OUTPUT -p tcp --dport 8040:8043 -j DROP -m comment --comment "Block unauthorized RMM"
Use auditd to monitor for ScreenConnect binary execution
auditctl -w /opt/ScreenConnect -p x -k rmm_execution

5. Forensic Artifacts of DLL Sideloading Attacks

When responding to an incident involving sideloading, collect specific artifacts to reconstruct the attack chain and identify the malicious DLL.

Key artifacts and collection commands:

  • Prefetch files (C:\Windows\Prefetch\) – show execution of `TESTDISK-SETUP.EXE-.pf` and MSEXEC-SIDELOAD.pf.
  • Amcache.hve – records execution of Microsoft binary from non-standard paths.
  • Event Logs:
    – `Microsoft-Windows-Sysmon/Operational` Event ID 7 (DLL load) – look for `Image` = Microsoft binary and `ImageLoaded` = path under user temp or ProgramData.
    – `Security` Event ID 4688 – process creation with command line arguments showing silent RMM install.
  • MFT (Master File Table) – timestamps showing creation of malicious DLL shortly before Microsoft binary execution.

PowerShell script to collect artifacts:

$output = "C:\Case\DLLSideloading_$(Get-Date -Format yyyyMMdd)"
mkdir $output -Force
 Export Sysmon events
wevtutil epl "Microsoft-Windows-Sysmon/Operational" "$output\sysmon.evtx"
 Copy prefetch
Copy-Item "C:\Windows\Prefetch\TESTDISK.pf" $output
 Extract Amcache
reg.exe save HKLM\ROOT\System\CurrentControlSet\Control\SessionManager\AppCompatCache $output\amcache.hve
 List all DLLs loaded by Microsoft-signed processes (save to CSV)
Get-Process | Where-Object {$<em>.Modules.FileName -like "Microsoft" -and $</em>.Path -notlike "C:\Windows\System32\"} | Select-Object -ExpandProperty Modules | Export-Csv "$output\sideloaded_dlls.csv"
  1. API Security and Supply Chain Lessons from Fake TestDisk

The TestDisk incident highlights risks in software supply chains – even open-source tools are mimicked. API security parallels: attackers poison package repositories (npm, PyPI) with typosquatted libraries that execute sideloading techniques.

Step‑by‑step API supply chain protection:

  1. Verify package integrity using SHA256 hashes from official sources, not mirrors. 
    For Python packages
pip download testdisk --no-deps
sha256sum testdisk-.whl
  2. Implement repository allowlisting in CI/CD pipelines: block downloads from domains not in a trusted allowlist (e.g., only pypi.org, not testdisk.dev).

3. Use software bill of materials (SBOM) scanners:

syft dir:/app -o json | grype

4. For cloud hardening: Enforce VPC endpoints for package managers so downloads never traverse the public internet.
5. Train developers to recognize SEO poisoning in search results for dependencies and tools.

What Undercode Say

  • SEO poisoning is not just a consumer problem – enterprises must monitor for typosquatted domains of their critical third-party tools and block them via DNS threat intelligence feeds.
  • DLL sideloading remains a reliable bypass because security products often trust Microsoft-signed binaries. Defenders need behavior-based rules (e.g., “trusted binary loading untrusted DLL from user-writable directory”).
  • RMM tools are the new C2 frameworks – attackers exploit their legitimate nature to evade detection. Organizations must inventory and strictly control all remote access software, even those with valid signatures.

Prediction

As search engines rely more on AI-generated summaries and sponsored results, SEO poisoning will become more sophisticated, using generative AI to clone entire legitimate websites with perfect visual fidelity. Expect attackers to pivot to abusing other signed system binaries (e.g., from antivirus vendors or cloud agents) for sideloading. Within 12 months, we will see a major supply chain attack where a trojanized installer for a popular open-source tool leads to ransomware deployment across thousands of endpoints, forcing platforms like GitHub and SourceForge to implement real-time hash verification for all downloads.

▶️ Related Video (76% Match):

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Seopoisoning Rmm – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: