17 Days Inside a Vet Clinic: How One Spam Email Became a Remote-Control Backdoor

A single click in a Spam folder gave an attacker full remote control of a front-desk computer at a small veterinary clinic for 17 days. They used that time to go after the clinic's billing, shopping and email accounts, mostly at night and on weekends. Here is how it happened, what we found, and what every small practice can do this week to stop it.

The first 12 minutes

It started on an ordinary Tuesday morning. A staff member was checking the clinic's webmail between appointments and opened the Spam folder. Twenty-nine seconds later, a file called ScreenConnect.ClientSetup.msi ran from their Downloads folder.

ScreenConnect is a real, widely used remote-support tool. IT companies use it every day to help their clients. That is exactly why attackers like it: it looks legitimate, it is digitally signed, and once it is installed the person on the other end can see the screen, move the mouse, type and transfer files.

The Windows event logs let us rebuild what happened next, second by second:

1.       8:38 AM. The installer runs. The first attempt is cancelled, and the user tries again. It installs and connects to a ScreenConnect cloud account the attacker had set up.

2.       8:39 AM. A remote operator calling themselves "Tammy Davenport" connects.

3.       5 seconds later. The operator pushes a second installer to the computer and runs it. This copy connects to a server the attacker controls, not to ScreenConnect's cloud.

4.       34 seconds after connecting, the operator disconnects. The job was done.

5.       8:50 AM. Using the second copy, the attacker runs a one-line command that downloads and silently installs a third copy from another attacker server.

6.       8:56 AM. An operator now calling themselves "Administrator" connects and stays for two hours.

In 12 minutes, the attacker had turned one mistaken click into three separate ways back in, all running with full administrative rights. Removing one would not have locked them out. This speed is a sign of a practiced, scripted playbook, not an opportunist.

What the attacker did with 17 days of access

The attacker connected 28 times over 17 days, for a little over six hours in total. ScreenConnect logs when someone connects and disconnects, but not what they do on screen. To fill that gap, we lined the sessions up against the computer's web browser history.

The clinic uses this computer on weekdays from about 7:50 AM to 6:00 PM and on Saturday mornings. Every single page visited outside those hours happened while the attacker was connected. Each of those sessions was short and went straight to something worth money:

Payment portals, order histories and shopping sites are the classic targets of fraud: saved cards, gift-card purchases, and invoices that can be quietly redirected. The employer account matters too. Criminals use real employer accounts to send fake job offers to applicants.

The attacker also connected for several hours during clinic hours, while staff were working in the practice-management system. They did not need to click anything to do damage there. They could simply watch client names, addresses, invoices and payment history go by on screen.

Why the antivirus stayed quiet

The clinic had a reputable endpoint security product installed and running the whole time. It raised no alarm, and that was not a failure of the product.

ScreenConnect is legitimate, signed software that thousands of IT providers rely on. Security tools allow it by default, because blocking it would break real support work.

The attacker did not need malware. They used a trusted tool the way it was designed to be used, only with the wrong person on the other end.

Abusing legitimate remote-access tools has become a common way into small businesses. The fix is not a better antivirus. It is deciding in advance which remote-access tools are allowed on your computers, and blocking everything else.

How to protect your practice

Most of these steps cost nothing and take an afternoon. Start at the top.

1.       Make one rule and repeat it often. Nobody installs remote-support software, or lets anyone connect to their computer, because an email, a pop-up or a caller asked them to. Hang up and call your IT provider on a number you already have.

2.       Treat the Spam folder as dangerous. It is there for a reason. If something in it looks important, ask before you click.

3.       Take away everyday admin rights. Staff accounts should not be able to install software. In this case, the install worked because the user's account could approve it.

4.       Block remote-access tools you don't use. Have your IT provider allow only the one remote-support tool they use, and block ScreenConnect, AnyDesk, TeamViewer and the rest.

5.       Stop saving passwords in the browser on shared computers. The attacker reached several accounts without typing a single password, because the browser filled them in. Use a password manager instead.

6.       Turn on two-step verification everywhere it is offered, starting with email, Google or Microsoft accounts, banking, supplier portals and job boards.

If you think someone has already been on one of your computers, do not just uninstall the tool. Disconnect the computer from the network, change your passwords from a different device, check your accounts for orders or payments you did not make, and call for help.

Indicators for other defenders

If you manage endpoints, these are worth adding to your DNS and firewall block lists and hunting for in your logs. Domains are written with brackets so they are not clickable.

On Windows, look for new services named "ScreenConnect Client (...)" (System log, event ID 7045). Also look for ScreenConnect connect, file-transfer and command events (Application log, event IDs 100, 200 and 201) that your IT team cannot explain.

The bottom line

This attack did not need a software flaw or a clever exploit. It needed one email, one click and a trusted tool. The same playbook works just as well against dental offices, law firms and accounting practices as it did against this clinic.

Firestorm Cyber investigates incidents like this one and helps small businesses lock down remote access before it becomes a problem. If something on this list worries you, or a computer in your office is acting strangely, contact us at info@firestormcyber.com.