Threats Tagged 'rmm tools'

Threat actors are distributing legitimate Remote Monitoring and Management (RMM) tools such as ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able through phishing campaigns. These campaigns use social engineering tactics with fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing remote access tools disguised as business documents. Delivery methods include LNK files, BAT scripts, VBS files, and PDFs. The RMM tools contain embedded configuration data linking back to attacker infrastructure, enabling remote access while evading detection.

Between January and April 2026, a coordinated social engineering operation named Spring Ring leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, targeting over 150 employees across at least 10 companies. Adversaries initiated voice phishing calls to coerce victims into executing remote monitoring and management tools or custom malware. In advanced variants, attackers transitioned from vishing to NTLM relay attacks targeting domain controllers. Two distinct campaigns were observed: Campaign A utilized RMM tools and obfuscated PowerShell-based RATs, while Campaign B employed tailored cloud infrastructure with PetitPotam exploitation for domain-level compromise. The operation demonstrates the weaponization of trusted collaboration platforms as primary attack vectors, exploiting the trust gap in SaaS applications.

A misconfigured Python HTTP server on a Budapest VPS exposed the complete operational infrastructure of three distinct phishing operators. The investigation uncovered codemado, an Egyptian threat actor operating since 2018, running a full AiTM platform with custom tools including MaDoO Blaster; saroula01, deploying OAuth Device Code Flow attacks that accumulated 218 victims across 12 countries over a year; and mail-argenta, a Nigerian operator identified through infostealer logs containing his own credentials. All three actors leveraged customized Evilginx forks and AI-assisted development to build MFA-bypass infrastructure from public GitHub repositories. The campaigns targeted Microsoft 365 accounts primarily, with codemado maintaining ties to RockyBelling's "The Quarry" cybercrime ecosystem. The exposed server contained phishing configurations, credential logs, RMM installers, combolists, and Telegram session files, revealing sustained operations from at least January 2025 through May 2026.

MediumMalwareUnited StatesAustraliaBrazil+8#madoo blaster#asyncrat#rmm tools

A sophisticated phishing campaign leverages evolved ClickFix techniques to bypass modern endpoint security through victim-assisted execution. Targets receive emails with urgent OneDrive document lures containing malicious ZIP attachments. The attack uses LNK shortcuts that redirect victims to landing pages, silently injecting PowerShell commands into their clipboard. Through social engineering, victims are tricked into manually executing commands via Win+R, circumventing traditional security filters. The campaign employs DNS TXT records for payload staging, avoiding HTTP detection. The threat infrastructure hosts multiple malicious components including obfuscated scripts, fake MSI installers masquerading as legitimate software like ConnectWise, and ISO images with spyware for persistent access. This represents a shift toward long-game tactics focused on establishing full post-compromise environmental control.

A cargo theft threat actor maintained access to a decoy environment for over a month, providing extensive visibility into post-compromise operations. The attacker established redundant persistence using multiple remote access tools, including four ScreenConnect instances, Pulseway RMM, and SimpleHelp RMM. A previously unknown signing-as-a-service capability was employed to evade detection by re-signing ScreenConnect installers with fraudulent code-signing certificates. Extensive reconnaissance targeted financial platforms, payment systems, cryptocurrency wallets, and transportation-specific services including fuel card providers, fleet payment platforms, and load board operators. The activity strongly aligns with financially motivated crimes against the transportation industry, including freight diversion and cargo theft operations.

The UNK_SmudgedSerpent threat actor, likely linked to Iranian espionage efforts, targeted academics and foreign policy experts from June to August 2025 using phishing campaigns with domestic political and health-related lures. The actor employed Remote Management & Monitoring (RMM) tools and credential harvesting techniques, showing overlapping tactics with known Iranian groups such as TA455, TA453, and TA450. Although attribution is not definitive, the targeting aligns with Iranian intelligence priorities, focusing on sensitive policy and academic sectors. The campaign's medium severity reflects moderate impact potential without known exploits in the wild. European organizations involved in foreign policy, academia, and research are at risk, especially in countries with strong diplomatic ties or geopolitical interest in Iran. Mitigation requires targeted user awareness, strict monitoring of RMM tool usage, and enhanced email filtering tuned to political and health-themed lures. Countries like Germany, France, the UK, Italy, and the Netherlands are most likely affected due to their active academic communities and diplomatic engagement with Iran. The threat's medium severity is due to its espionage focus, moderate ease of exploitation via phishing, and the absence of widespread destructive payloads or zero-day exploits. Defenders should prioritize detection of credential harvesting and suspicious RMM activity while maintaining vigilance for evolving Iranian espionage tactics.

MediumCampaignGermanyFranceItaly+2#credential harvesting#isl online#minibike