Mesh Agent
Mesh Agent is a remote access and remote management tool observed being deployed by threat actors as a post-exploitation payload. In the provided reporting, it appeared in at least two contexts: as a final payload in a large-scale malware campaign identified by McAfee in January 2026, and in multiple April 2025 intrusion cases analyzed by Huntress involving exploitation of CVE-2025-31161 in CrushFTP and CVE-2025-30406 in Gladinet CentreStack/Triofox. In the McAfee-tracked campaign, victims were infected through trojanized ZIP archives masquerading as legitimate software such as AI tools, game hacks, VPNs, drivers, decryptors, and infostealer tools. The infection chain used DLL side-loading via WinUpdateHelper.dll, browser redirection to a fake dependency download, persistence through a Windows service named Microsoft Console Host, and in-memory PowerShell execution; in some cases that PowerShell payload delivered Mesh Agent alongside other payloads such as SalatStealer and cryptocurrency miners. In the Huntress cases, attackers deployed Mesh Agent via PowerShell commands after exploiting internet-facing software vulnerabilities. Several CrushFTP incidents involved Mesh Agent being installed from C:\Windows\Temp and configured to connect to hxxps://rtb[.]mftadsrvr[.]com:2087; related reporting also states it was configured to connect to rtb[.]mftadsrvr[.]com. The same activity cluster also involved IP address 2.58.56[.]16, downloads from 196.251.85[.]31 in some cases, and associated delivery of a malicious d3d11.dll and a renamed executable, Centre.exe, detected as Cobalt Strike. High-confidence indicators directly mentioned in the content include rtb[.]mftadsrvr[.]com, hxxps://rtb[.]mftadsrvr[.]com:2087, installation from C:\Windows\Temp, and association with exploitation of CrushFTP and Gladinet CentreStack/Triofox vulnerabilities.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
“Key tools include remote management software like SimpleHelp and AnyDesk, as well as Mesh Agent for remote access.”
Microsoft Defender Experts identified multiple phishing campaigns... The campaigns used workplace meeting lures, PDF attachments... Phishing emails directed users to download malicious executables masquerading as legitimate software.
In one observed campaign, victims received the following email which included a fake PDF attachment... A red button labeled “Open in Adobe” encouraged the user to click... when clicked... redirects users to a spoofed webpage crafted to closely mimic Adobe’s official download center.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Stealth
2 techniques
Stealth
Lateral Movement
1 technique
Lateral Movement
“attacker could remotely control the system, move laterally across the network, harvest sensitive data, and push additional payloads” | “silently deployed remote monitoring and management (RMM) tools, specifically ScreenConnect, Tactical RMM, and Mesh Agent, giving the attacker persistent and stealthy control”
Command and Control
3 techniques
Command and Control
At this stage, the service established an outbound network connection to the attacker-controlled Command and Control (C2) domain: trustconnectsoftware[.]com
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access tool delivered as a final payload in some infections of the campaign, likely to provide remote control of compromised systems.
Mesh Agent is a remote access tool/backdoor deployed by attackers to gain persistent access and control over compromised systems, often used for lateral movement and further exploitation.
Mesh Agent is a remote monitoring and management (RMM) tool that was installed by threat actors post-exploitation to maintain persistent remote access to compromised endpoints.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.