Loading malware…
Syncro is a legitimate, cloud-managed remote monitoring and management (RMM) platform for managed service providers and corporate IT teams. Threat actors abuse its signed agents to obtain remote access to Windows endpoints, maintain persistence, execute commands, and deploy additional software. These deployments use attacker-controlled service accounts or tenants rather than an inherently malicious Syncro codebase. Legitimate signatures and vendor infrastructure can help unauthorized installations blend into normal administrative activity and evade security controls.
Malicious distribution includes invitation-themed phishing, invoice and payment PDF lures linking to hosted installers, and counterfeit Microsoft Teams pages. Installers have also been disguised as Adobe, DocuSign, or Dotloop software. Observed installations include signed, self-contained packages and MSI wrappers configured with operator-specific tenant identifiers. Attackers have used an installed Syncro agent to launch Windows Installer and deploy additional RMM tools, particularly ConnectWise ScreenConnect, providing redundant remote access.
Syncro abuse has been associated with MuddyWater, Chaos, Royal, CSuite, and Storm-2949. Storm-2949 deployed Syncro alongside ScreenConnect for endpoint persistence after Microsoft Entra ID account takeover. CSuite included Syncro among the legitimate management tools delivered in phishing operations targeting organizations in the United States and Europe. Credential theft and cloud-control-plane abuse conducted in these broader operations are distinct from Syncro's own functionality.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
CSuite déploie Syncro parmi les outils de gestion légitimes renommés en Adobe, Dotloop ou DocuSign.
Alongside three ScreenConnect MSI siblings ... two Syncro/Servably MSI wrappers ... drop a byte-identical 5.6 MB Kabuto.Installer.Installer.InstallSyncro .NET payload ... MALWARE ... Syncro / Servably, Inc. (legitimate RMM abused via operator-tenant deployment alongside ScreenConnect)
Legitimate remote management tools, including Atera, AnyDesk, Syncro, SimpleHelp, and NetBird, were systematically abused to establish persistent remote access...
18 distinct techniques documented for this family, organized by ATT&CK tactic.
CSuite used archives on its shared-hosting account and installers committed to a public code-hosting account to deliver payloads.
Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email.
credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.
“Legitimate management tools can be abused to gain persistent access to employee devices” and “direct remote control of employee devices.”
SimpleHelp ... is often used in phishing campaigns involving “invitation” lures in which the victim is encouraged to download and execute an invite to a party (e.g. Ecard9140.exe ).
A common lure is themed as a Social Security statement ( ssa.msi ) in an attempt to convince the victim they need to run the file to retrieve their statement.
MuddyWater began using "fully signed" and legitimate RMM tools as part of its attack chain in 2020, often by including links in phishing emails designed to trick victims into downloading and executing RMM installers.
Livraison du payload : ... script batch/VBS téléchargeant l'installeur.
Livraison du payload : archive, installeur MSI, ou script batch/VBS téléchargeant l'installeur.
Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email.
credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.
“Legitimate management tools can be abused to gain persistent access to employee devices” and “direct remote control of employee devices.”
Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email.
credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.
Even when the file is renamed to something like party_invite.exe , or Voicemailaudioext.exe ... A common lure is themed as a Social Security statement ( ssa.msi ) ... using lures such as a document ( docmentfilecsm_jw98evavuqm5gb3.exe ) or an IRS tax-related file ( IRS-Statement_Pr2ui4J9cfA6YEu.exe ).
Déploiement d'outils légitimes de gestion ... renommés en Adobe, Dotloop, DocuSign.
Adversaries frequently sign up for a free trial of a legitimate service (like LogMeIn Resolve or Syncro) using a throwaway email.
credential-phishing serves as the initial-access vector, with a "technical interview" social-engineering pretext during which the operator drives an MFA-fatigue / SSPR-rotation sequence to seize Microsoft Entra ID accounts.
문제는 이러한 기능이 정상적으로 서명된 MSI 설치 파일 형태로 배포된다는 점입니다. 위협 행위자는 이를 악용해 합법적인 Syncro 에이전트 MSI 파일을 생성한 뒤, 스피어피싱 메일의 첨부파일이나 다운로드 링크로 유포하여 초기 침투 수단으로 활용할 수 있습니다.
Exécution : élévation via UAC + msiexec sur le package agent.
Page d'atterrissage : faux viewer Adobe Reader, DocuSign, Zoom ou Dropbox ; outils renommés en Adobe, Dotloop, DocuSign.
Over the last few years, threat actors have flocked to exploit legitimate remote monitoring and management (RMM) tools—blue-chip IT software like ScreenConnect, LogMeIn Resolve, and PDQ Connect—blurring the line between legitimate IT administration and malicious intrusion.
Les scripts batch/VBS téléchargent l'installeur, et le compte GitHub Ivan3900 héberge les installateurs ScreenConnect.
Adversaries in this report have abused remote management software such as Connectwise, Atera, and Syncro to launch malicious commands to victim environments.
The final payload observed in these campaigns is ScreenConnect, a remote monitoring and management (RMM) tool used to control victim machines.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.