Malware

Splashtop

Splashtop is a legitimate remote monitoring and management (RMM) / remote administration tool that has been observed used by threat actors post-compromise to establish and maintain access. Mandiant reported deployment of Splashtop following successful exploitation of Citrix NetScaler ADC/Gateway CVE-2023-4966, alongside Atera and AnyDesk, as part of post-exploitation activity that also included Active Directory reconnaissance, internal network scanning, credential theft, and lateral movement via RDP. SentinelLABS also observed Black Basta operators using Splashtop as one of several remote administration tools, alongside NetSupport Manager, GoToAssist, Atera Agent, and SystemBC. The provided content does not describe Splashtop as malware itself, but as legitimate software abused by multiple threat actors for persistence and remote access.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1133External Remote ServicesEvidence2

Another common method observed to maintain access is by installing third-party remote access software such as AnyDesk, TeamViewer, Splashtop and Atera.

Execution

3 techniques

T1072Software Deployment ToolsEvidence1

T1072. Software Deployment Tools Trigona operators use Splashtop to move laterally and transfer malware between compromised hosts in the victim’s environment.

T1204User ExecutionEvidence1

“Posed as company IT and/or helpdesk staff to direct employees to run commercial remote access tools enabling initial access [T1204] [T1219] [T1566].”

T1204.002Malicious FileEvidence1

The link in either page led to the installer for Tiflux, Network Solutions Agreement.msi

Persistence

1 technique

T1133External Remote ServicesEvidence2

Another common method observed to maintain access is by installing third-party remote access software such as AnyDesk, TeamViewer, Splashtop and Atera.

Stealth

2 techniques

T1036MasqueradingEvidence2

CISA and the FBI included technical advice victims can turn to when investigating Medusa attacks, noting that the hackers use several credential stealing tools before turning to legitimate remote monitoring software to evade detection.

T1218System Binary Proxy ExecutionEvidence1

The shift shows that threat actors are ditching conventional hacking tools and increasingly embracing living-off-the-land (LotL) tactics, in which attackers leverage legitimate software and command-line tools to evade threat detection.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

run commands to collect system profiling information and interrogate the operating system

Lateral Movement

3 techniques

T1021Remote ServicesEvidence4

The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop.

T1072Software Deployment ToolsEvidence1

T1072. Software Deployment Tools Trigona operators use Splashtop to move laterally and transfer malware between compromised hosts in the victim’s environment.

T1570Lateral Tool TransferEvidence2

T1570. Lateral Tool Transfer Trigona operators use Splashtop to transfer malicious tools from computer to computer in the victim’s environment.

Collection

1 technique

T1113Screen CaptureEvidence1

we observed the two RMMs connect to the servers used to manage them, transmit screenshots and screenshot thumbnails

Command and Control

4 techniques

T1090.002External ProxyEvidence1

Many RMM tools provide end-to-end encryption and are accessed through vendor-operated relay servers, obviating the need for traditional command-and-control (C2) infrastructure that can be tracked by researchers and blocked by network security devices.

T1105Ingress Tool TransferEvidence4

BYOT (Bring Your Own Tools) We are astonished by the number of tools brought into an intrusion.

T1219Remote Access ToolsEvidence25

45% of endpoint-related incidents Huntress investigated involved abuse of remote monitoring and management (RMM) tools... a fake service agreement installed Tiflux before quietly stacking UltraVNC, Splashtop and ScreenConnect on the same device.

T1573Encrypted ChannelEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

RMM tools often enable file sharing between compromised machines and those of attackers, as well as the execution of arbitrary commands. These features empower attackers to easily drop and execute additional tools or malware, or exfiltrate data.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

2 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Splashtop