Loading malware…
AnyDesk is a legitimate remote desktop and administration application, not an inherently malicious malware family. It supports interactive screen control, file transfer, unattended access, and session recording. Threat actors abuse these capabilities to obtain unauthorized access, maintain persistence, conduct post-compromise operations, transfer additional payloads, and exfiltrate data.
Malicious deployments frequently involve silent installation, installation as a service, and configuration of an attacker-controlled unattended-access password. AnyDesk can serve as an interactive command-and-control channel or a redundant access mechanism alongside other remote-management tools and malware implants. Its legitimate administrative role allows attackers to take advantage of trusted or allowlisted software; operators may also rename its executable or delete its logs to reduce visibility. Abuse is extensively documented on Windows endpoints and servers.
Distribution includes phishing and spear-phishing lures, fraudulent diagnostic downloads, and voice-based social engineering through telephone or Microsoft Teams calls. Attackers also install AnyDesk after exploiting public-facing applications, including Apache ActiveMQ, FortiClient EMS, and Samsung MagicINFO. These vulnerabilities provide the initial compromise rather than constituting AnyDesk exploitation.
AnyDesk abuse spans ransomware, cybercrime, and espionage operations. Documented users include Medusa, Akira, Qilin affiliates, Magnet Goblin, and Scattered Spider subclusters. North Korea-aligned developer-targeting campaigns also deploy it through InvisibleFerret. Victims span multiple industries and regions, including aerospace organizations and software developers involved in cryptocurrency and decentralized finance.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In the recently identified attack, the threat actor additionally installed AnyDesk after installing Netcat.
CVE-2025-31161 is a 9.8 CVSS critical severity vulnerability that affects how the CrushFTP file transfer application handles user authentication... CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass.
Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.
...Fortinet FortiClient EMS... exploited... The vulnerability in question is CVE-2023-48788... SQL injection...
22 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
An attacker posed as a known client during a Microsoft Teams call, convincing the victim to install AnyDesk, which facilitated the deployment of DarkGate malware.
An attacker posed as a known client during a Microsoft Teams call, convincing the victim to install AnyDesk, which facilitated the deployment of DarkGate malware.
An attacker posed as a known client during a Microsoft Teams call, convincing the victim to install AnyDesk, which facilitated the deployment of DarkGate malware.
An attacker posed as a known client during a Microsoft Teams call, convincing the victim to install AnyDesk, which facilitated the deployment of DarkGate malware.
An attacker posed as a known client during a Microsoft Teams call, convincing the victim to install AnyDesk, which facilitated the deployment of DarkGate malware.
This BAT script downloads and executes AnyDesk and was downloaded from another server, 23.184.48[.]132, which is also associated with ScreenConnect payloads.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Once executed, get.js copies several campaign components... The JavaScript then launches g.bat... Systems that do not match these checks follow a PowerShell based execution path... [other systems] execute the 64-bit AS branch through w.py.
Their first attempt used a Windows download utility and their second used PowerShell; Microsoft Defender stopped both.
The actor set DisableRestrictedAdmin to 0 and configured SafeBoot AnyDesk entries and Winlogon automatic logon values.
50 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate remote-access software deployed by a Qilin affiliate through Atera, with another remote-access channel maintained for redundancy.
Legitimate remote-management software weaponized in this incident as a rogue remote-access mechanism after compromise.
Legitimate remote-administration software abused by the campaign as an independently installed fallback channel for interactive access after compromise.
Used by the attackers as an alternate remote access channel across the network in incidents that later culminated in ransomware deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.