# The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access

> The Quarry is an active Phishing-as-a-Service and Malware-as-a-Service operation, run by an actor known as RockyBelling, that has supplied phishing toolkits to roughly 200 affiliate operators since April 2025. Affiliates impersonate the US IRS, Social Security Administration, and brands such as Adobe, Microsoft, DocuSign, and Dropbox to deliver remote access via legitimate ConnectWise ScreenConnect RMM software, using Adspect traffic cloaking and Telegram-based command and exfiltration infrastructure to evade detection.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0805
- **ID:** TL-2026-0805
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** RockyBelling
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Quarry is a turnkey Phishing-as-a-Service (PhaaS) and Malware-as-a-Service (MaaS) operation documented by SOCRadar in June 2026 and active since at least April 2025. The operation is operated by a developer/seller using the alias RockyBelling (also Rock, Rockky, Mike), who markets the kit through a Telegram channel named "Rocky War Room" (~194 subscribers at analysis) and hosts ScreenConnect MSI installers, post-exploitation scripts, and bot tokens in a GitLab account. Arabic-language comments found in kit files suggest a possible regional connection, though origin is unconfirmed.

The Quarry sells tiered services: an entry-level "Rocky Gmail Sender" mass-mailer for ~$500, a self-hosted ScreenConnect panel setup for ~$2,000 with ~$100/month maintenance, and a full campaign setup with guidance for ~$3,000. Approximately 200 affiliate operators have enrolled. Each affiliate is provisioned a self-hosted ScreenConnect instance with a per-affiliate RSA-4096 certificate and a pre-compiled MSI installer for that panel.

The attack chain runs through six phases. Distribution uses the Rocky Gmail Sender with subject-line randomization, HTML templates, and sector/domain email scraping. Phase 1 performs initial filtering: index.php detects User-Agent and redirects non-Windows visitors to errorPage.php while appending random ~300-character URL fragments to defeat session correlation. Phase 2 applies Adspect traffic cloaking with WebGL vendor/renderer analysis, timezone validation, browser-object checks, nested-frame detection, TouchEvent analysis, and Array.prototype.includes fingerprinting; bots are 301-redirected to webmail.windstream.net while real victims proceed. Adspect stream_id reuse clusters campaigns by operator. Phase 3 serves high-fidelity lure pages, most prominently a fake SSA portal (SSA seal, "Estimated Benefits," "Earnings Record," "Security Verification" sections, 5-step interaction flow), with secondary Adobe, Dropbox, DocuSign, and Messenger panels on the same backend.

Phase 4 delivers payloads via a web kit (de.php selects a random variant from /sources/, stages it in a unique 12-character /downloads/ subdirectory, and delivers it through a hidden iframe) across three kit versions (X, Y, Z). Version Z adds a keepalive.php heartbeat (every 5s), a 3-second post-download redirect to webmail.windstream.net, and a safe_cleanup() directory-expiration routine. A VBS dropper introduced April 2026 uses ShellExecute with the runas verb for UAC elevation, downloads an RMM MSI from GitHub/GitLab raw-content URLs alongside a decoy PDF (commonly social-security-statement-upd.pdf), and installs the MSI silently via /quiet ALLUSERS=2 using MSXML2.ServerXMLHTTP.6.0 and ADODB.Stream COM objects, staging in TEMP and self-deleting afterward; obfuscation evolved from Base64 concatenation to hex encoding to an AES-decrypted PS1 second stage.

Phase 5 exfiltrates real-time victim telemetry (IP, User-Agent, filename, UTC timestamp, source file, direct link) to affiliate Telegram bots via HTTPS POST to api.telegram.org, requiring no panel access. Phase 6 post-exploitation tooling includes a PowerShell browser-history stealer (closes Chrome/Edge, exports 6 months of history to CSV via a runtime-downloaded SQLite binary), a W-2 document finder (recursive scan of C:\Users\{username}\ for filenames containing "w2"), the promoted VioletRAT (cookie recovery, credential dumping, background control), and AWS credential harvesting from publicly exposed JavaScript. The operation behaves as a likely Initial Access Broker pipeline, with access potentially resold to ransomware operators. SOCRadar observed 500+ distinct victim IPs across 14 countries, with 94.7% of victims in the United States, spanning SaaS/Dev, Healthcare, Media, and Fintech sectors. Infrastructure spans 80+ phishing domains and 40+ ScreenConnect panels (primary ASN 23470 / ReliableSite, distinctive JARM fingerprints, Let's Encrypt issuance timing).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1589 Gather Victim Identity Information
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1219 Remote Access Tools
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1217 Browser Information Discovery
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [The Quarry: PhaaS/MaaS Operation Targeting IRS and SSA via Phishing](https://socradar.io/blog/the-quarry-phaas-irs-ssa-phishing/)
- [CISA AA23-025A: Protecting Against Malicious Use of Remote Monitoring and Management Software](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-025a)
- [Joint CSA (CISA/NSA/MS-ISAC): Protecting Against Malicious Use of RMM Software (PDF)](https://www.cisa.gov/sites/default/files/2023-02/aa23-025a-protecting-against-malicious-use-of-rmm-software.pdf)
- [MITRE ATT&CK T1219: Remote Access Software](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK T1566: Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1548.002: Abuse Elevation Control Mechanism - Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002/)
- [MITRE ATT&CK T1071.001: Application Layer Protocol - Web Protocols (Telegram API C2)](https://attack.mitre.org/techniques/T1071/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0805