Loading malware…
MeshAgent is the legitimate, open-source endpoint agent for the MeshCentral remote-management platform, frequently abused by threat actors as a remote-access tool. Observed malicious deployments target Windows and Linux systems. It supports interactive remote desktop control, command execution, file transfers, and hardware and software inventory collection. The agent uses configuration data identifying its management server and connects over WebSocket, allowing attackers to operate their own MeshCentral infrastructure.
Attackers deploy MeshAgent to maintain persistent access after exploitation, establish a secondary remote-control channel, conduct reconnaissance, move laterally, and download or activate additional implants. Malicious deployments may rename the agent or customize its service identity to resemble legitimate software. Distribution includes invoice-themed phishing archives with script-based downloaders, spearphishing links to attacker-controlled download pages, and installation following exploitation of internet-facing applications. PhantomCore has used phishing sites with fake CAPTCHAs to deliver the agent.
Documented users include LilacSquid, Awaken Likho, PhantomCore, Toy Ghouls, and ShinyHunters, tracked as UNC6240. UNC6240 deployed MeshAgent for persistence on Linux hosts following exploitation of Oracle PeopleSoft. The tool has also appeared in Qilin, Medusa, and Settra ransomware intrusions. Its presence does not inherently establish malicious activity: unauthorized deployment, management-server ownership, and associated endpoint behavior distinguish attacker abuse from legitimate administration. Credential theft, keylogging, and ransomware activity elsewhere in these intrusion chains are not intrinsic MeshAgent capabilities.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group leverages MeshAgent for maintaining post-compromise persistence following successful exploitation. Upon execution, MeshAgent connects to its C2 server, conducts initial reconnaissance and downloads or activates additional implants.
The group leverages MeshAgent for maintaining post-compromise persistence following successful exploitation. Upon execution, MeshAgent connects to its C2 server, conducts initial reconnaissance and downloads or activates additional implants.
MeshAgent, Splashtop, RustDesk, AnyDesk, Atera and even Chrome Remote Desktop have all turned up across Qilin incidents.
As final payloads, the attackers use LockBit and Babuk ransomware, as well as Tactical RMM and MeshAgent to maintain persistence.
“MeshAgent for persistent access on Linux, calling out to domains built to look like Microsoft services.”
Toy Ghouls uses remote-administration tools including MeshAgent, RuDesktop, and AnyDesk for lateral movement. Observed MeshAgent samples connected to C2 servers also previously seen in Head Mare activity.
+7 more in the app. View in Mallory
14 distinct techniques documented for this family, organized by ATT&CK tactic.
k0t has been observed using Namecheap to acquire domains for their campaigns.
it seems that the threat actor attacked the development company and distributed installers with malware strains
tâche planifiée \MeshUserTask (MeshAgent)
“After gaining access, the extortion group deploys web shells, a legitimate RMM tool (MeshAgent) and performs fileless command execution.”
"SmartApeSG ClickFix to unidentified RAT to MeshAgent" and "SmartApeSG fake verification page with ClickFix instructions."
a malicious setup file is uploaded to the website of a Korean VPN service provider instead of the normal installer. Accordingly, users may mistakenly think that they have executed a normal setup file, but a malware strain is also installed in the system and executed.
PsExec is one of the most consistent lateral movement and deployment tools used by Storm-2570 ... to move laterally and install renamed MeshAgent binaries across compromised environments.
tâche planifiée \MeshUserTask (MeshAgent)
tâche planifiée \MeshUserTask (MeshAgent)
Storm-2570 ... uses Base64-encoding to obfuscate the commands being executed.
The actor renames MeshAgent-related binaries or services with victim-themed names, such as meshagent64-[organization name].exe, likely to make the tool appear more legitimate.
Most malware samples had certificates disguised as valid ones from this company. There were also multiple samples signed with valid certificates.
"Login console from the malicious Mesh C2 server."
MeshAgent... communicating over encrypted WebSocket (WSS) to an attacker-controlled server... T1071.001 Application Layer Protocol: Web Protocols
The infection did not immediately deploy all of its components. Instead, the threat actor maintained a presence on the system and introduced additional tooling over the course of several days.
Operators abused a wide array of remote access tools, these included: Atera, Teramind, AnyDesk, ngrok as well as MeshCentral/MeshAgents and AdaptixC2.
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.