Skip to main content
Mallory
MalwareRansomwareUsed by 7 actorsExploits 2 CVEs

AnyDesk

AnyDesk is a legitimate remote desktop and remote monitoring/management tool that is repeatedly documented in the provided content as being abused by threat actors for direct remote access, persistence, and secondary command-and-control across intrusions. It is described as being installed on compromised Windows systems and servers, including domain controllers and beachhead hosts, often as a backup access channel or auto-start service after initial compromise. Reported use cases include attacker persistence following exploitation of Apache ActiveMQ CVE-2023-46604, deployment by Akira affiliates during ransomware intrusions, use by Trigona operators for direct remote access alongside credential theft tooling, deployment by MuddyWater/Seedworm and Peach Sandstorm in Iranian state-linked operations, and use in broader cybercriminal campaigns where remote management tools are delivered to victims.

The content associates AnyDesk with multiple threat actors and clusters, including Akira affiliates, Trigona affiliates, MuddyWater/Seedworm, Peach Sandstorm/HOLMIUM, and actors involved in TOAD-style social engineering and Cloudflare-tunnel-based malware delivery. In some cases it was deployed through downloaders such as HTTP_VIP, which Group-IB reported as authenticating to codefusiontech[.]org and deploying AnyDesk; Rapid7 also observed MuddyWater-linked operators establishing persistence with AnyDesk after Microsoft Teams social engineering. Microsoft reported Peach Sandstorm deploying AnyDesk in a subset of intrusions to maintain access. In ransomware and network intrusion reporting, AnyDesk was installed on breached systems, domain controllers, and servers to facilitate hands-on-keyboard access.

The content also includes infrastructure-level observations of AnyDesk exposed on TCP port 7070, where stock AnyDesk services on ThinkHuge-hosted Windows VPS infrastructure were initially misclassified as unknown C2 listeners because they require a proper TLS ClientHello and do not respond to raw bytes. Those services used self-signed certificates with subject CN=AnyDesk Client, serial number 01, RSA-2048 keys, and 50-year validity. Identified AnyDesk management hosts were 38.57.40.237:7070, 38.57.41.81:7070, 38.57.44.11:7070, and 38.57.44.232:7070, with corresponding SHA-256 certificate fingerprints 56:40:AE:B0:2A:C2:E0:E6:36:DB:6A:1E:6C:95:E7:DE:5E:35:27:F2:9A:B4:8E:E0:AF:5A:5A:2E:FF:CF:ED:7C, 7F:78:95:42:6E:B2:56:9D:26:C7:2C:D8:9C:D7:06:0D:00:D7:F9:67:8D:31:B0:1C:E7:E9:B5:FD:35:AC:7B:12, C0:2C:B0:8A:D4:21:4C:EC:07:CD:C8:B5:85:D2:6B:55:9D:34:52:E3:5F:FF:E9:43:3D:40:C5:04:8D:D6:B4:CB, and 69:68:00:2F:50:BA:60:34:8B:1E:24:BD:51:3D:83:03:EC:7A:11:3B:E2:AA:15:F4:CC:EE:D5:CB:35:70:BE:32.

A separate report describes a purpose-built AnyDesk RAT used in the Contagious Interview campaign. That malware silently downloaded and installed AnyDesk, stole configuration and credential material from service.conf, exfiltrated it, injected attacker-controlled credential material into service.conf, and restarted AnyDesk to provide persistent remote desktop access. Reported hardcoded values written into service.conf included pwd_hash 967adedce518105664c46e21fd4edb02270506a307ea7242fa78c1cf80baec9d, pwd_salt 351535afd2d98b9a3a0e14905a60a345, and token_salt e43673a2a77ed68fa6e8074167350f8f; that RAT used C2 server 95.164.17.24:1224.

Additional indicators directly mentioned in the content include AnyDesk Client ID 1148037084 from the LockBit-related ActiveMQ intrusion, and a malware artifact named pdmemeAna.dll described as an AnyDesk RAT. Overall, the provided content consistently characterizes AnyDesk as legitimate software frequently repurposed by attackers to maintain remote access, persistence, and operator control in both cybercriminal and state-linked intrusions.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES
CVE-2025-12480Authentication Bypass and RCE in Gladinet TriofoxExploited in the wild

Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.

via securityaffairssecurityaffairs.com
CVE-2023-48788SQL Injection RCE in Fortinet FortiClient EMSExploited in the wild

...Fortinet FortiClient EMS... exploited... The vulnerability in question is CVE-2023-48788... SQL injection...

via cloudatg insightscloudatg.com
THREAT ACTORS

Groups observed using it

7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
MuddyWater

In at least one instance, the TA deployed a remote management tool (AnyDesk) to further facilitate access.

via rapid7 blograpid7.com
Crypt Ghouls

"The group’s arsenal includes well-known hacking tools such as... AnyDesk."

via security online infosecurityonline.info
Contagious Interview

"...an AnyDesk module (which deploys the AnyDesk remote access tool to allow direct attacker access...)"

via eset welivesecurity blogwelivesecurity.com
CL-STA-0240

...initiate the installation of the AnyDesk remote access software.

via the hacker newsthehackernews.com
Druidfly

Use of the remote desktop tools AnyDesk and ScreenConnect

via symantec blogsecurity.com
APT33

"...Peach Sandstorm deployed AnyDesk, a commercial remote monitoring and management tool (RMM) to maintain access to a target."

via industrialcyberindustrialcyber.co
GS7

In many cases, victims were prompted to download remote monitoring and management tools such as LogMeIn, AnyDesk or ScreenConnect, giving attackers persistent access to compromised systems.

via govinfosecuritygovinfosecurity.com
MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

T1588.002ToolEvidence2

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Initial Access

5 techniques
T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1133External Remote ServicesEvidence2

T1133 - External Remote Services The threat actor gained initial access via the externally facing Remote Desktop Web Access service on a gateway that brokers RDP connections into the victim’s environment, enabling the threat actor to establish an RDP session.

T1189Drive-by CompromiseEvidence1

The recipient visiting the first-stage malicious domain triggers the download of an executable.

T1566PhishingEvidence1

Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software—ScreenConnect (now ConnectWise Control) and AnyDesk—which the actors used in a refund scam to steal money from victim bank accounts.

T1566.002Spearphishing LinkEvidence1

The emails either contain a link to a “first-stage” malicious domain or prompt the recipients to call the cybercriminals, who then try to convince the recipients to visit the first-stage malicious domain.

Execution

1 technique
T1204User ExecutionEvidence1
TacticExecution

The recipient visiting the first-stage malicious domain triggers the download of an executable.

Persistence

4 techniques
T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1133External Remote ServicesEvidence2

T1133 - External Remote Services The threat actor gained initial access via the externally facing Remote Desktop Web Access service on a gateway that brokers RDP connections into the victim’s environment, enabling the threat actor to establish an RDP session.

T1543.003Windows ServiceEvidence2

T1543.003 - Create or Modify System Process: Windows Service Various Windows services were created across multiple compromised systems to establish remote access.

T1547.009Shortcut ModificationEvidence1

On a separate endpoint, AnyDesk was installed, creating both a Windows service and a startup shortcut so it launched automatically on every reboot.

T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

T1543.003Windows ServiceEvidence2

T1543.003 - Create or Modify System Process: Windows Service Various Windows services were created across multiple compromised systems to establish remote access.

T1547.009Shortcut ModificationEvidence1

On a separate endpoint, AnyDesk was installed, creating both a Windows service and a startup shortcut so it launched automatically on every reboot.

Stealth

1 technique
T1078Valid AccountsEvidence1

authorities warn the same tactics could be used by APT actors in order to gain persistence within a network.

Lateral Movement

2 techniques
T1021Remote ServicesEvidence4

Once the malware is running, it deploys a variety of remote access tools like AnyDesk and TightVNC.

T1570Lateral Tool TransferEvidence1

There are also functions present in the binary that deal with remote control capabilities using AnyDesk remote desktop, which allows the attacker to interact with the user machine during a banking session.

T1090ProxyEvidence1

The attackers use AnyDesk, Cloudflare Tunnel, RustDesk, Ngrok, and Cloudflare Tunnel to communicate with the command-and-control (C&C).

T1105Ingress Tool TransferEvidence4

Mid-April 2026: Using business- and tax-related themes in attacks targeting organizations in Japan and Germany to deliver RomulusLoader, which is then used to deploy AnyDesk and SyncFuture via DLL side-loading

T1219Remote Access ToolsEvidence27

TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.

Exfiltration

1 technique
T1041Exfiltration Over C2 ChannelEvidence1

RMM has become a more prominent vector for initial access, persistence, and data exfiltration

INDICATORS OF COMPROMISE

IOCs tracked for this family

2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app1 month ago
ip.v4●●●●●●●●●●●●View more in app4 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching2

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution7

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.