Loading malware…
Mesh Agent is a remote access and remote management tool observed being deployed by threat actors as a post-exploitation payload. In the provided reporting, it appeared in at least two contexts: as a final payload in a large-scale malware campaign identified by McAfee in January 2026, and in multiple April 2025 intrusion cases analyzed by Huntress involving exploitation of CVE-2025-31161 in CrushFTP and CVE-2025-30406 in Gladinet CentreStack/Triofox. In the McAfee-tracked campaign, victims were infected through trojanized ZIP archives masquerading as legitimate software such as AI tools, game hacks, VPNs, drivers, decryptors, and infostealer tools. The infection chain used DLL side-loading via WinUpdateHelper.dll, browser redirection to a fake dependency download, persistence through a Windows service named Microsoft Console Host, and in-memory PowerShell execution; in some cases that PowerShell payload delivered Mesh Agent alongside other payloads such as SalatStealer and cryptocurrency miners. In the Huntress cases, attackers deployed Mesh Agent via PowerShell commands after exploiting internet-facing software vulnerabilities. Several CrushFTP incidents involved Mesh Agent being installed from C:\Windows\Temp and configured to connect to hxxps://rtb[.]mftadsrvr[.]com:2087; related reporting also states it was configured to connect to rtb[.]mftadsrvr[.]com. The same activity cluster also involved IP address 2.58.56[.]16, downloads from 196.251.85[.]31 in some cases, and associated delivery of a malicious d3d11.dll and a renamed executable, Centre.exe, detected as Cobalt Strike. High-confidence indicators directly mentioned in the content include rtb[.]mftadsrvr[.]com, hxxps://rtb[.]mftadsrvr[.]com:2087, installation from C:\Windows\Temp, and association with exploitation of CrushFTP and Gladinet CentreStack/Triofox vulnerabilities.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
“Key tools include remote management software like SimpleHelp and AnyDesk, as well as Mesh Agent for remote access.”
Microsoft Defender Experts identified multiple phishing campaigns... The campaigns used workplace meeting lures, PDF attachments... Phishing emails directed users to download malicious executables masquerading as legitimate software.
In one observed campaign, victims received the following email which included a fake PDF attachment... A red button labeled “Open in Adobe” encouraged the user to click... when clicked... redirects users to a spoofed webpage crafted to closely mimic Adobe’s official download center.
These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...
These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.
These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...
These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...
“attacker could remotely control the system, move laterally across the network, harvest sensitive data, and push additional payloads” | “silently deployed remote monitoring and management (RMM) tools, specifically ScreenConnect, Tactical RMM, and Mesh Agent, giving the attacker persistent and stealthy control”
At this stage, the service established an outbound network connection to the attacker-controlled Command and Control (C2) domain: trustconnectsoftware[.]com
These PowerShell commands retrieved the ScreenConnect client installer files (.msi) and staged them within the systems’ temporary directory paths in preparation for secondary deployment.
In early May, the attackers focused on running additional scans and deploying ManageEngine’s Endpoint Central RMM (Remote Monitoring and Management) to establish persistence... Further RMM-type applications, such as Mesh Agent and Tactical RMM, were installed in the days that followed.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access tool delivered as a final payload in some infections of the campaign, likely to provide remote control of compromised systems.
Mesh Agent is a remote access tool/backdoor deployed by attackers to gain persistent access and control over compromised systems, often used for lateral movement and further exploitation.
Mesh Agent is a remote monitoring and management (RMM) tool that was installed by threat actors post-exploitation to maintain persistent remote access to compromised endpoints.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.