ConnectWise ScreenConnect Remote Access Software
ConnectWise ScreenConnect is a legitimate remote access software delivered as part of phishing campaigns using The Quarry kit.
Tag: remote access
VioletRAT Malware
VioletRAT is a remote access trojan included in The Quarry PhaaS kit, used for post-compromise access.
Remote Utilities: Commercial RAT Used in SCMBANKER Attacks
Remote Utilities is a commercial remote-access tool that is deployed by the SCMBANKER malware to provide hands-on access to victim machines. It…
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
Go2Tunnel: Remote Access and Network Tunneling Tool
Go2Tunnel is a tool used by Armored Likho for remote access and network tunneling, establishing reverse SSH tunnels to C2 servers. It…
NetScaler Gateway: Secure Remote Access Solution
NetScaler Gateway is a Citrix product that provides secure remote access, including SSL VPN, ICA Proxy, CVPN, and RDP Proxy. It is…
Zoho Assist: Remote Access Tool Abused by Storm-2603
Zoho Assist was used by Storm-2603 as one of multiple remote access channels during ransomware attacks, alongside Cloudflare tunneling and SSH.
Citrix Receiver: Remote Access Client
Citrix Receiver is a remote access client whose signed binary was abused for DLL sideloading by Mustang Panda.
DEV#POPPER RAT: Remote Access Trojan in PolinRider Campaign
A remote access trojan delivered as a second-stage payload in the PolinRider campaign. Unpacked from encrypted payloads fetched via blockchain services like…
Ngrok
Ngrok is a tool that creates secure tunnels to localhost. Qilin ransomware affiliates used Ngrok for remote access and reconnaissance during intrusions…