Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A spam campaign targeting Brazilian users, particularly C-level executives and financial/HR accounts, has been identified since January 2025. The campaign exploits commercial remote monitoring and management (RMM) tools, specifically PDQ Connect and N-able remote access tools. Attackers use Brazilian electronic invoice system (NF-e) as bait, leading victims to malicious content on Dropbox. The threat actor, likely an initial access broker, abuses free trial periods of RMM tools to gain complete control of target machines. The campaign's objective is to create a network of compromised machines for potential sale to third parties, including ransomware operators and state-sponsored actors. The abuse of commercial RMM tools is increasing due to their digital signatures, full backdoor capabilities, and low cost.

This threat involves a spam campaign primarily targeting Brazilian users, with a focus on high-value targets such as C-level executives and financial or HR personnel. The attackers exploit commercial Remote Monitoring and Management (RMM) tools, specifically PDQ Connect and N-able remote access tools, to gain unauthorized access to victim machines. The campaign uses the Brazilian electronic invoice system (NF-e) as a lure, directing victims to malicious content hosted on Dropbox. The attackers leverage free trial periods of these RMM tools to establish persistent, fully backdoored access to compromised systems. These RMM tools are attractive to attackers because they are digitally signed, which helps evade detection, and provide comprehensive remote control capabilities. The ultimate goal of the campaign is to build a network of compromised machines that can be sold to third parties, including ransomware operators and state-sponsored threat actors. The campaign employs multiple tactics and techniques such as initial access brokering, social engineering via spam, and abuse of legitimate software to bypass security controls. Although the campaign is currently focused on Brazil, the abuse of RMM tools is a growing trend globally due to their stealth and effectiveness in establishing long-term access.

Detailed information about Spam campaign targeting Brazil abuses Remote Monitoring and Management tools. Get real-time updates, technical details, and mitigatio

Title	Severity	Type	Source	Date

Threats Tagged 'pdq connect'

Filter Threats

Threats Tagged 'pdq connect'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility