Tag: remote access tool

9 Attack Reports | 0 Vulnerabilities

Attack reports

In-Memory Loader Drops ScreenConnect

In February 2026, an attack chain was discovered that utilized a fraudulent Adobe Acrobat Reader download page to deceive victims into installing ConnectWise's ScreenConnect, a legitimate remote access tool exploited for malicious purposes. The attack employs sophisticated evasion techniques includ…
screenconnect
in-memory execution
remote access tool
uac bypass
2026-04-10
com abuse
peb manipulation
powershell staging
vbscript loader
Published: April 10, 2026
Downloadable IOCs: 3

New Remcos Campaign Distributed Through Fake Shipping Document

A new phishing campaign has been discovered that delivers a fileless variant of the Remcos RAT. The attack begins with an email impersonating a Vietnamese shipping company, luring victims to open a malicious Word document. This document retrieves a remote RTF file, exploits a vulnerability, and exe…
phishing
remcos
CVE-2017-11882
process hollowing
remcos rat
remote access tool
fileless malware
2026-01-19
Published: January 19, 2026
Linked vulnerabilities : CVE-2017-11882
Downloadable IOCs: 13

Deceptive Layoff-Themed HR Email Distributes Remcos RAT Malware

A malicious email campaign exploits workforce anxieties by disguising itself as internal HR announcements about layoffs. The emails contain a RAR archive with a double-extension executable masquerading as a PDF document. Upon execution, the file deploys Remcos RAT, a remote access tool, which estab…
phishing
social engineering
remcos rat
remote access tool
2025-12-09
hr lure
layoff-themed
Published: December 9, 2025
Downloadable IOCs: 3

DPRK's Playbook: HttpTroy and New BLINDINGCAN Variant

Recent investigations have uncovered two new toolsets from North Korean threat actors. Kimsuky deployed a new backdoor called HttpTroy, targeting a victim in South Korea through a VPN invoice-themed attack. The attack chain involves a dropper, a loader called MemLoad, and the HttpTroy backdoor, whi…
backdoor
obfuscation
espionage
comebacker
dprk
stealth
remote access tool
2025-11-03
blindingcan
httptroy
Published: November 3, 2025
Downloadable IOCs: 15

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate …
obfuscation
screenconnect
phishing
social engineering
malvertising
infostealer
macos
darkgate
lumma stealer
latrodectus
remote access tool
mintsloader
atomic macos stealer (amos)
lampion
2025-08-21
windows run dialog
Published: August 21, 2025
Downloadable IOCs: 10

Be Careful With Fake Zoom Client Downloads

A deceptive email containing a fake Zoom meeting invitation has been identified. Clicking the 'join' button leads to a website prompting users to install a purported Zoom client update. The downloaded executable, 'Session.ClientSetup.exe', is actually malware that installs an MSI package. This pack…
screenconnect
phishing
downloader
fake update
remote access tool
zoom
2025-06-05
Published: June 5, 2025
Downloadable IOCs: 2

Fake Social Security Statement emails trick users into installing remote tool

A phishing campaign is targeting users with fake emails purportedly from the US Social Security Administration. These emails aim to trick recipients into installing ScreenConnect, a legitimate remote access tool that can be misused by cybercriminals. The campaign, attributed to a group called Molat…
screenconnect
phishing
social engineering
financial fraud
remote access tool
2025-05-01
social security administration
Published: May 1, 2025
Downloadable IOCs: 0

Thunderstruck! Malicious ads for RVTools lead to ThunderShell payload

A security incident involving malicious sponsored ads distributing backdoored administrative tools was detected. Users searching for RVTools were served a tampered version containing ThunderShell, a PowerShell-based remote access tool. The malicious ads, appearing in Google search results, led to a…
malvertising
powershell
icedid
google ads
c2
remote access tool
2025-04-03
thundershell
rvtools
trojanized software
Published: April 3, 2025
Downloadable IOCs: 0

Agent Tesla Indicators of Compromise (IOC) Feed

Agent Tesla is a sophisticated malware functioning primarily as a keylogger, capable of capturing sensitive data like usernames and passwords from infected computers. It can also take screenshots, extract credentials from various software, and act as a remote access tool. The malware's versatility …
agent tesla
keylogger
2024-09-18
remote access tool
Published: September 18, 2024
Downloadable IOCs: 9
Click here to see more Attack Reports