Threats Tagged 'pdq'

Threat actors are increasingly abusing legitimate Remote Monitoring and Management (RMM) tools such as PDQ and GoTo Resolve to deploy secondary RMM tools like ScreenConnect or SimpleHelp, enabling persistent and stealthy access. Attacks often start with phishing emails or malicious downloads, targeting diverse sectors including real estate, investment firms, and car dealerships. Social engineering lures include holiday-themed messages and fake bid transcripts to trick users into executing malicious payloads. The abuse of multiple RMM tools complicates detection and remediation efforts. Detection and mitigation require a managed Security Operations Center (SOC) with visibility into RMM tool usage and network behavior. The threat is medium severity due to the potential for persistence and lateral movement, but exploitation requires initial user interaction. European organizations using these RMM tools are at risk, especially those in Germany and countries with high adoption of these management platforms. Practical mitigations include strict RMM access controls, multi-factor authentication, monitoring for unusual RMM deployments, and user training against phishing. No known exploits in the wild have been reported yet, but the trend indicates growing attacker interest in RMM abuse for persistence and lateral movement.

MediumCampaignGermanyFranceNetherlands+2#rmm abuse#phishing#social engineering