Threat reportPhishingTL-2026-3415
RSVP to Disaster: Fake Event-Invitation Phishing Delivers ConnectWise ScreenConnect as RAT
RSVP to Disaster (TL-2026-3415), also tracked as RSVP to Disaster, is a high-severity phishing campaign, first published 2026-10-13. It has no confirmed attribution, affects ConnectWise ScreenConnect (legitimate software abused as RAT; no, maps to 8 MITRE ATT&CK techniques (T1036.005, T1204.001, T1204.002), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-3415
- Threat ID
- TL-2026-3415
- Also known as
- RSVP to Disaster, EdesktopInvite campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in RSVP to Disaster
Malware and tooling: ConnectWise - S0591, ConnectWise ScreenConnect, ScreenConnect
How RSVP to Disaster works
Cofense Phishing Defense Center reports a phishing campaign using 'You are cordially invited' event-invitation emails that route victims through a fake CAPTCHA and a fake invitation page to download a zip containing ScreenConnect.exe, giving attackers remote access via legitimate ConnectWise ScreenConnect software. The campaign targets a broad user base and no attribution is stated.
Cofense Phishing Defense Center (analyst Willmar Cheng, published 2026-10-13) describes a phishing campaign that abuses the legitimate remote support tool ConnectWise ScreenConnect as a remote access trojan (RAT). The lure is a deliberately vague event invitation: the subject reads 'You are cordially invited' and the body reads 'Join Us for a Special Gathering, Let Us Celebrate a Milestone', with no concrete event details, which lets the same message work across a diverse pool of recipients.
The victim clicks 'Click Here to Download the Invite' and is redirected to a fake CAPTCHA verification page hosted on a newly registered, unbranded domain (theinvitationestateco[.]vu). After passing the CAPTCHA, the victim reaches a second fake invitation page with an 'eInvite' button. The button forces the download of a zip archive named 'ViewDePartyyinvites' containing ScreenConnect.exe; the sampled installer is ScreenConnect.ClientSetup.exe (12,809,272 bytes). The reported infection URL is https://theinvitationestateco[.]vu/EdesktopInvite/ and the payload URL is https://theinvitationestateco[.]vu/EdesktopInvite/RsvpNow/invitedetails[.]php. The domain resolved to 104.21.73.121 and 172.67.162.73.
Once the victim runs the installer, the attacker has interactive remote access to the endpoint. The only visible indication is a taskbar icon, and the use of genuine, signed-looking remote-support software helps the payload avoid antivirus detection. Cofense does not state a sector focus, threat actor, or ScreenConnect relay/instance details. Related reporting shows the same abuse pattern in other lure themes: Cofense documented a Zoom-themed ScreenConnect chain in May 2026, and Abnormal documented Zoom and Microsoft Teams invitation lures in 2025 that reached over 900 organizations, where ScreenConnect access was used for follow-on lateral phishing and access resale. Those campaigns are not confirmed to be linked to this one. A BeaconBeagle lookup for 104.21.73.121 returned HTTP 404 (no record), so no C2 correlation was found. The IPs sit in Cloudflare address ranges and are likely fronting addresses, not origin infrastructure.
Defensive priorities are blocking the domain and URL paths, alerting on ScreenConnect installs that were not deployed by IT, and detecting zip/exe downloads that follow a CAPTCHA page.
MITRE ATT&CK techniques used in TL-2026-3415
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Execution
T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1219 Remote Access Tools; T1219.002 Remote Desktop Software
Initial Access
Resource Development
Affected products and versions in RSVP to Disaster
- ConnectWise — ScreenConnect (legitimate software abused as RAT; no vulnerability exploited)
- Microsoft — Windows (endpoints running the downloaded ScreenConnect client)
Remediation for RSVP to Disaster
Immediate actions
- Block theinvitationestateco.vu and the /EdesktopInvite/ URL paths at web proxy, DNS and email gateways
- Hunt endpoints for ScreenConnect.ClientSetup.exe with SHA256 f3aab811ae8163e09db40db201facc7e189d1a1b161be265202ca54b39b5e6cc or MD5 739a54032b89432bb4c9c33969f6b383
- Search mail logs for the subject 'You are cordially invited' and purge matching messages
- Isolate hosts with unapproved ScreenConnect client installs and reset credentials used on them
Workarounds
- Block ScreenConnect relay traffic from endpoints that do not need it
- Strip or sandbox zip attachments and downloads containing executables from uncategorized domains
Longer-term hardening
- Application-control allowlist so only IT-sanctioned remote access tools can run
- Alert on new ScreenConnect service or client installs outside change windows
- Train users on fake CAPTCHA pages and unsolicited invitation downloads
- Restrict zip/exe downloads from newly registered domains
Timeline of RSVP to Disaster
- Abnormal publishes research on Zoom/Teams-themed phishing delivering ScreenConnect, affecting over 900 organizations (related technique, not confirmed linked)
- Cofense publishes Zoom-themed ScreenConnect campaign analysis (VBS downloader chain), a related but separate campaign
- Cofense publishes 'RSVP to Disaster: How One Click Installs a RAT' with IOCs; no attribution or sector targeting stated
- Cofense reports forced download of zip 'ViewDePartyyinvites' containing ScreenConnect.exe (ScreenConnect.ClientSetup.exe, 12,809,272 bytes), giving attackers remote access
- Cofense reports victims redirected to a fake CAPTCHA on newly registered domain theinvitationestateco.vu, then to a fake invitation page with an 'eInvite' button
- Cofense PDC reports phishing emails with subject 'You are cordially invited' and a 'Click Here to Download the Invite' button
Sources cited for RSVP to Disaster
- RSVP to Disaster: How One Click Installs a RAT
- Click, Install, Compromised: The New Wave of Zoom-Themed Attacks
- ScreenConnect Abuse Phishing Campaign (Abnormal)
- Attackers Leverage Fake Zoom Invites to Deliver Remote Access Tool During Tax Season
- Trusted Deception: Fake Microsoft Teams Invitation Leading to ScreenConnect
- MITRE ATT&CK T1219 Remote Access Tools
Detection coverage for TL-2026-3415
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3415 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.