LogMeIn
LogMeIn is a remote access and support software. Qilin ransomware affiliates used LogMeIn for reconnaissance and remote access during post-exploitation activities after…
Tag: remote access
RedHook Android Trojan Resurfaces with Wireless ADB Abuse
RedHook is an Android trojan that has resurfaced with new capabilities including autonomous privilege abuse via Android's Wireless ADB Debugging. It provides…
ConnectWise ScreenConnect Remote Access Software
ConnectWise ScreenConnect is a legitimate remote access software delivered as part of phishing campaigns using The Quarry kit.
VioletRAT Malware
VioletRAT is a remote access trojan included in The Quarry PhaaS kit, used for post-compromise access.
Remote Utilities: Commercial RAT Used in SCMBANKER Attacks
Remote Utilities is a commercial remote-access tool that is deployed by the SCMBANKER malware to provide hands-on access to victim machines. It…
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup…
Go2Tunnel: Remote Access and Network Tunneling Tool
Go2Tunnel is a tool used by Armored Likho for remote access and network tunneling, establishing reverse SSH tunnels to C2 servers. It…
Zoho Assist: Remote Access Tool Abused by Storm-2603
Zoho Assist was used by Storm-2603 as one of multiple remote access channels during ransomware attacks, alongside Cloudflare tunneling and SSH.
Citrix Receiver: Remote Access Client
Citrix Receiver is a remote access client whose signed binary was abused for DLL sideloading by Mustang Panda.
DEV#POPPER RAT: Remote Access Trojan in PolinRider Campaign
A remote access trojan delivered as a second-stage payload in the PolinRider campaign. Unpacked from encrypted payloads fetched via blockchain services like…