AnyDesk
AnyDesk is a legitimate remote desktop and remote monitoring/management tool that is repeatedly documented in the provided content as being abused by threat actors for direct remote access, persistence, and secondary command-and-control across intrusions. It is described as being installed on compromised Windows systems and servers, including domain controllers and beachhead hosts, often as a backup access channel or auto-start service after initial compromise. Reported use cases include attacker persistence following exploitation of Apache ActiveMQ CVE-2023-46604, deployment by Akira affiliates during ransomware intrusions, use by Trigona operators for direct remote access alongside credential theft tooling, deployment by MuddyWater/Seedworm and Peach Sandstorm in Iranian state-linked operations, and use in broader cybercriminal campaigns where remote management tools are delivered to victims.
The content associates AnyDesk with multiple threat actors and clusters, including Akira affiliates, Trigona affiliates, MuddyWater/Seedworm, Peach Sandstorm/HOLMIUM, and actors involved in TOAD-style social engineering and Cloudflare-tunnel-based malware delivery. In some cases it was deployed through downloaders such as HTTP_VIP, which Group-IB reported as authenticating to codefusiontech[.]org and deploying AnyDesk; Rapid7 also observed MuddyWater-linked operators establishing persistence with AnyDesk after Microsoft Teams social engineering. Microsoft reported Peach Sandstorm deploying AnyDesk in a subset of intrusions to maintain access. In ransomware and network intrusion reporting, AnyDesk was installed on breached systems, domain controllers, and servers to facilitate hands-on-keyboard access.
The content also includes infrastructure-level observations of AnyDesk exposed on TCP port 7070, where stock AnyDesk services on ThinkHuge-hosted Windows VPS infrastructure were initially misclassified as unknown C2 listeners because they require a proper TLS ClientHello and do not respond to raw bytes. Those services used self-signed certificates with subject CN=AnyDesk Client, serial number 01, RSA-2048 keys, and 50-year validity. Identified AnyDesk management hosts were 38.57.40.237:7070, 38.57.41.81:7070, 38.57.44.11:7070, and 38.57.44.232:7070, with corresponding SHA-256 certificate fingerprints 56:40:AE:B0:2A:C2:E0:E6:36:DB:6A:1E:6C:95:E7:DE:5E:35:27:F2:9A:B4:8E:E0:AF:5A:5A:2E:FF:CF:ED:7C, 7F:78:95:42:6E:B2:56:9D:26:C7:2C:D8:9C:D7:06:0D:00:D7:F9:67:8D:31:B0:1C:E7:E9:B5:FD:35:AC:7B:12, C0:2C:B0:8A:D4:21:4C:EC:07:CD:C8:B5:85:D2:6B:55:9D:34:52:E3:5F:FF:E9:43:3D:40:C5:04:8D:D6:B4:CB, and 69:68:00:2F:50:BA:60:34:8B:1E:24:BD:51:3D:83:03:EC:7A:11:3B:E2:AA:15:F4:CC:EE:D5:CB:35:70:BE:32.
A separate report describes a purpose-built AnyDesk RAT used in the Contagious Interview campaign. That malware silently downloaded and installed AnyDesk, stole configuration and credential material from service.conf, exfiltrated it, injected attacker-controlled credential material into service.conf, and restarted AnyDesk to provide persistent remote desktop access. Reported hardcoded values written into service.conf included pwd_hash 967adedce518105664c46e21fd4edb02270506a307ea7242fa78c1cf80baec9d, pwd_salt 351535afd2d98b9a3a0e14905a60a345, and token_salt e43673a2a77ed68fa6e8074167350f8f; that RAT used C2 server 95.164.17.24:1224.
Additional indicators directly mentioned in the content include AnyDesk Client ID 1148037084 from the LockBit-related ActiveMQ intrusion, and a malware artifact named pdmemeAna.dll described as an AnyDesk RAT. Overall, the provided content consistently characterizes AnyDesk as legitimate software frequently repurposed by attackers to maintain remote access, persistence, and operator control in both cybercriminal and state-linked intrusions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.
...Fortinet FortiClient EMS... exploited... The vulnerability in question is CVE-2023-48788... SQL injection...
Groups observed using it
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In at least one instance, the TA deployed a remote management tool (AnyDesk) to further facilitate access.
"The group’s arsenal includes well-known hacking tools such as... AnyDesk."
"...an AnyDesk module (which deploys the AnyDesk remote access tool to allow direct attacker access...)"
...initiate the installation of the AnyDesk remote access software.
"...Peach Sandstorm deployed AnyDesk, a commercial remote monitoring and management tool (RMM) to maintain access to a target."
In many cases, victims were prompted to download remote monitoring and management tools such as LogMeIn, AnyDesk or ScreenConnect, giving attackers persistent access to compromised systems.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 techniqueThe content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
Initial Access
5 techniquesauthorities warn the same tactics could be used by APT actors in order to gain persistence within a network.
T1133 - External Remote Services The threat actor gained initial access via the externally facing Remote Desktop Web Access service on a gateway that brokers RDP connections into the victim’s environment, enabling the threat actor to establish an RDP session.
The recipient visiting the first-stage malicious domain triggers the download of an executable.
Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software—ScreenConnect (now ConnectWise Control) and AnyDesk—which the actors used in a refund scam to steal money from victim bank accounts.
The emails either contain a link to a “first-stage” malicious domain or prompt the recipients to call the cybercriminals, who then try to convince the recipients to visit the first-stage malicious domain.
Execution
1 techniqueThe recipient visiting the first-stage malicious domain triggers the download of an executable.
Persistence
4 techniquesauthorities warn the same tactics could be used by APT actors in order to gain persistence within a network.
T1133 - External Remote Services The threat actor gained initial access via the externally facing Remote Desktop Web Access service on a gateway that brokers RDP connections into the victim’s environment, enabling the threat actor to establish an RDP session.
T1543.003 - Create or Modify System Process: Windows Service Various Windows services were created across multiple compromised systems to establish remote access.
Privilege Escalation
3 techniquesauthorities warn the same tactics could be used by APT actors in order to gain persistence within a network.
T1543.003 - Create or Modify System Process: Windows Service Various Windows services were created across multiple compromised systems to establish remote access.
Stealth
1 techniqueLateral Movement
2 techniquesOnce the malware is running, it deploys a variety of remote access tools like AnyDesk and TightVNC.
There are also functions present in the binary that deal with remote control capabilities using AnyDesk remote desktop, which allows the attacker to interact with the user machine during a banking session.
Command and Control
3 techniquesThe attackers use AnyDesk, Cloudflare Tunnel, RustDesk, Ngrok, and Cloudflare Tunnel to communicate with the command-and-control (C&C).
Mid-April 2026: Using business- and tax-related themes in attacks targeting organizations in Japan and Germany to deliver RomulusLoader, which is then used to deploy AnyDesk and SyncFuture via DLL side-loading
TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.
Exfiltration
1 techniqueRMM has become a more prominent vector for initial access, persistence, and data exfiltration
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate remote access software abused to facilitate attacker access during the intrusion.
AnyDesk is used in the observed Trigona attacks to provide direct remote access on compromised systems.
AnyDesk was deployed for persistence and backup remote access, including SafeBoot persistence, as part of Akira intrusion activity preceding ransomware impact.
A suspected AnyDesk-based remote access payload indicated by the DLL naming pattern in the March 26 campaign, delivered through the actor's DLL registration workflow.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.