Ransomware Gangs Abuse Legitimate Remote Access Tools to Evade Security Controls
Ransomware operators are increasingly leveraging legitimate remote access tools (RATs) such as AnyDesk, Splashtop, UltraViewer, AppAnywhere, RustDesk, CloneDesk, and TightVNC to facilitate their attacks and bypass traditional security measures. These tools, originally intended for IT administration and remote support, are being misused by cybercriminals to gain persistent, stealthy access to victim networks. Attackers exploit the fact that these RATs are often whitelisted and trusted within enterprise environments, allowing them to evade endpoint detection and response (EDR) solutions and other security controls. The use of legitimate RATs enables adversaries to connect to compromised systems without user interaction, transfer malicious binaries, exfiltrate sensitive data, and execute administrative tasks remotely. Encrypted communications provided by these tools further help attackers avoid network monitoring and detection. Security researchers have observed a trend where ransomware gangs prefer these off-the-shelf RATs over custom malware, as their legitimate signatures and widespread use make them less likely to raise suspicion. The abuse of these tools is often facilitated by poor configuration, lack of monitoring, or inadequate management within organizations. Once inside a network, attackers use RATs to move laterally, harvest credentials, and disable security defenses before deploying ransomware payloads. The sophistication of these campaigns has increased, with adversaries employing advanced evasion techniques and maintaining long-term persistence. Organizations are advised to review their use of remote access tools, ensure proper configuration, and monitor for unusual activity associated with these applications. Security teams should also consider implementing stricter application whitelisting and network segmentation to limit the potential impact of RAT abuse. The trend highlights the need for continuous vigilance and updated security policies to address the evolving tactics of ransomware operators. The exploitation of trusted IT tools for malicious purposes underscores the importance of balancing operational convenience with robust security oversight. As ransomware attacks continue to evolve, defenders must adapt their detection and response strategies to account for the abuse of legitimate software. The growing reliance on RATs by threat actors represents a significant challenge for organizations seeking to protect their networks from ransomware threats. Proactive monitoring, user education, and regular security assessments are critical components in mitigating the risks associated with the misuse of remote access tools. Failure to address these vulnerabilities can result in significant data loss, operational disruption, and financial damage due to ransomware incidents.
Sources
Related Stories
Abuse of Legitimate Remote Access Tools for Lateral Movement and Persistence
Threat actors are increasingly leveraging legitimate remote access tools, such as PuTTY and various remote monitoring and management (RMM) platforms, to facilitate lateral movement, data exfiltration, and persistent access within compromised networks. Attackers exploit the "living off the land" nature of these tools, blending their malicious activities with normal administrative operations to evade detection. In the case of PuTTY, adversaries use binaries like `plink.exe` and `pscp.exe` to move laterally and exfiltrate sensitive data, often leaving behind subtle forensic traces such as SSH host keys in the Windows registry. These artifacts can be crucial for investigators to reconstruct attacker activity, even after extensive log and artifact cleanup by the attackers. Similarly, security researchers have observed a surge in incidents where multiple RMM tools are abused in attack chains. Threat actors compromise or install RMM platforms like ScreenConnect, TeamViewer, Atera, NinjaRMM, and GoTo Resolve to maintain long-term access and persistence. Attackers often use phishing lures to trick victims into installing rogue RMM software, and may deploy several RMM tools in succession to ensure continued access even if one is detected and removed. These tactics highlight the ongoing challenge for defenders in distinguishing between legitimate and malicious use of remote access utilities, underscoring the need for robust monitoring and baselining of such tools within enterprise environments.
2 months agoSurge in Cyberattacks Leveraging RMM Tools for Malware Deployment
Cybercriminals have increasingly targeted remote monitoring and management (RMM) tools to deploy malware and conduct large-scale cyberattacks. In 2025, attacks on RMM tools surged, with 51 different solutions identified as targets by security researchers. RMM tools, which became more prevalent during the COVID-19 pandemic to support remote work, are now being weaponized by threat actors due to their deep integration into enterprise IT environments. These tools, such as SuperOps and TeamViewer, are commonly used by IT professionals and managed service providers (MSPs) to remotely monitor, manage, and maintain client systems through centralized dashboards. Adversaries exploit these platforms by obtaining authenticated credentials, allowing them to bypass traditional security alerts and alarms. Once inside, attackers can disable scheduled backups, destroy system images and restore points, and push ransomware or other malicious payloads to thousands of endpoints simultaneously. The legitimate appearance of RMM tool traffic often allows malicious activity to evade anomaly detection systems, creating a persistent blind spot for network defenders. The elevated permissions typically granted to RMM platforms enable attackers to escalate privileges, move laterally within networks, and deliver malware efficiently. Compromising an MSP’s RMM infrastructure can have a supply chain effect, enabling attackers to pivot into multiple client environments and significantly amplifying the potential impact. This method of attack not only increases the blast radius but also enhances the monetization opportunities for cybercriminals. Security experts warn that the widespread use and trust in RMM tools make them an attractive and effective vector for cyberattacks. Organizations are urged to implement stronger authentication, monitor RMM tool usage closely, and restrict access to minimize risk. The trend highlights the need for enhanced vigilance and updated security controls around remote access and management solutions. The attacks demonstrate how tools designed for convenience and efficiency can become significant liabilities if not properly secured. The ongoing exploitation of RMM tools underscores the evolving tactics of cybercriminals in targeting trusted IT infrastructure. As attackers continue to refine their methods, defenders must adapt by prioritizing the security of remote management platforms. The surge in RMM tool exploitation serves as a stark reminder of the importance of supply chain security and the risks posed by third-party service providers. Organizations should review their incident response plans to ensure rapid detection and containment of attacks involving RMM platforms. The cybersecurity community continues to monitor this threat landscape, emphasizing the critical need for proactive defense measures.
5 months agoRecent Ransomware and Malware Campaigns Targeting Organizations and Individuals
A surge in sophisticated cyberattacks has been observed, with threat actors employing a variety of tactics to compromise organizations and individuals. Notable incidents include the use of the BYOVD (Bring Your Own Vulnerable Driver) technique to deploy DeadLock ransomware, as well as targeted campaigns leveraging phishing emails with HR-related lures to distribute Remcos RAT malware. Additionally, attackers are exploiting popular movie torrents to spread Agent Tesla via layered PowerShell scripts, and Android users in Spain are being targeted by the DroidLock ransomware, which can hijack devices and demand ransom through full-screen overlays. These campaigns demonstrate a trend toward multi-stage infection chains, abuse of legitimate tools and drivers, and the use of social engineering to increase the likelihood of successful compromise. Other significant developments include the targeting of Canadian organizations by the STAC6565/Gold Blade group using QWCrypt ransomware, and the emergence of new threat actor tactics such as disabling endpoint detection and response (EDR) systems to facilitate ransomware deployment. The threat landscape is further complicated by the activities of groups like Scattered Lapsus$ Hunters, who use social engineering and typosquatted domains to compromise Zendesk users, and the exposure of internal dynamics within ransomware groups like BlackBasta, revealing operational stress and internal mistrust. These incidents underscore the evolving nature of cyber threats, the blending of espionage and financial motives, and the increasing sophistication of both technical and social attack vectors.
3 months ago