MalwareUsed by 1 actor

RemoteUtilities

RemoteUtilities is a legitimate remote monitoring and management (RMM) tool that has been abused by threat actors, including Iranian state-linked operators such as MuddyWater, to evade detection and obtain remote access to victim systems. In the provided reporting, RemoteUtilities is listed among RMM tools tested or used by MuddyWater alongside ScreenConnect, Syncro, SimpleHelp, and Atera Agent. Documented capabilities in the content include taking screenshots on a compromised host and using msiexec to install a service. More broadly, the content states that Iranian threat actors have abused legitimate RMM tools such as Atera, Tactical, SimpleHelp, AnyDesk, ScreenConnect, and RemoteUtilities. No specific infection vector, victim sector, or standalone IOC uniquely tied to RemoteUtilities is provided in the content beyond its use as an abused legitimate RMM utility.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MuddyWater

"...tested different RMM tools, from ScreenConnect, Syncro, SimpleHelp, RemoteUtilies..."

via harfanglab insidethelabharfanglab.io

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence3

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

HarfangLab (April 2024) documented SimpleHelp and Atera campaigns where compromised corporate email accounts distributed links to RMM agents through file-sharing services (Egnyte, OneHub, Mega).

Stealth

1 technique

T1218.007MsiexecEvidence1

“AppleJeus delivered components using a Windows Installer package (.msi)… executed the 3CXDesktopApp.exe…”, “APT38 has used msiexec.exe to execute malicious files.”, “Rancor has used msiexec to download and execute malicious installer files over HTTP.”, “TA505 has used msiexec to download and execute malicious Windows Installer files.”

Discovery

1 technique

T1083File and Directory DiscoveryEvidence4

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Lateral Movement

1 technique

T1021Remote ServicesEvidence4

the attackers typically attempt to steal credentials and move laterally across the network.

Collection

1 technique

T1113Screen CaptureEvidence2

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1219Remote Access ToolsEvidence6

UAC-0056 (Pandora hVNC, RemoteUtilities, GrimPlant, GraphSteel)

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

arctic wolf blogNews

Jun 23, 2025

Cybersecurity Risks Amid Rising Iran–U.S. Tensions

A legitimate remote monitoring and management tool abused by Iranian threat actors for persistence and lateral movement.

harfanglab insidethelabNews

Mar 4, 2025

MuddyWater campaign abusing Atera Agents - HarfangLab

Legitimate remote administration/RMM tool referenced as one of the RMM products MuddyWater has tested/abused.

mitre attackNews

Jan 25, 2026

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Remote administration/RMM tool that can take screenshots (often abused).

mitre attackNews

Mar 18, 2026

Screen Capture, Technique T1113 - Enterprise | MITRE ATT&CK®

Can take screenshots on a compromised host.

+1 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

RemoteUtilities