Cybersecurity experts have identified a persistent trend of threat actors exploiting legitimate remote monitoring and management (RMM) software to infiltrate networks, maintain access, and facilitate lateral movement. These legitimate tools, which are typically used by IT administrators for system maintenance and support, provide attackers with powerful capabilities that often evade traditional security measures due to their trusted status within enterprise environments. These tools are widely deployed across organizations for legitimate purposes such as system updates, asset management, software deployment, and endpoint troubleshooting, making malicious usage difficult to detect. Intel471 analysts identified that attackers frequently gain initial access to RMM software by compromising user credentials through social engineering tactics or by exploiting vulnerabilities in outdated software. The unsuspecting employee was persuaded to install remote access software like AnyDesk, providing attackers with direct system access. In some cases, attackers take proactive steps to preserve illicit access by creating additional accounts within the RMM platform to maintain persistence even if compromised credentials are reset. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The query logic focuses on process names containing “AnyDesk.exe” while excluding common legitimate paths such as AppData, Downloads, and Program Files directories. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. When executed against Sysmon logs, this query can reveal instances where attackers have hidden RMM tools in unusual locations like the Public Music directory. Intel471 recommends organizations implement strict application control policies and monitor network connections from RMM tools to identify potentially malicious command and control traffic. Security teams can detect suspicious RMM deployments by identifying executions from abnormal locations in the file system. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Mar 2025 16:35:35 +0000