Malware

NinjaOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

T1566.002Spearphishing LinkEvidence1

The attack begins with phishing emails containing links hidden behind a Googleusercontent-based redirection chain... After clicking the link, victims are redirected to what appears to be a secure portal used to distribute protected business documents.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

T1204User ExecutionEvidence1

Victims are often contacted by phone and told to install what appears to be software required to access their document. This operator-guided method removes the need for exploits entirely and puts social engineering at the heart of the attack.

T1204.002Malicious FileEvidence1

At this point, the victim believes they are downloading a protected business document. The document never arrives. Instead, the download contains a legitimate NinjaOne installer configured to connect to attacker-controlled infrastructure.

Persistence

2 techniques

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

T1136Create AccountEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne... In parallel, the operator created a new user account named Support in several environments

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

Stealth

2 techniques

T1036MasqueradingEvidence1

The downloaded file was named NinjaOne-Agent-DocumentoFiscal21782856920262001238-Sede-Auto-x86-64, keeping the fiscal-document illusion alive right up to installation.

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence2

Using that illicit NinjaOne access, the operator obtained remote access to a mix of servers, workstations, and domain controllers spanning several customer environments.

T1570Lateral Tool TransferEvidence1

The group leverages Impacket tools (wmiexec, smbexec, atexec), PsExec, and legitimate RMM software (AnyDesk, Level.io, NinjaOne) for lateral movement

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence2

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

T1219Remote Access ToolsEvidence4

AnyDesk, NinjaOne, and Level.io are used for RMM persistence.

T1219.002Remote Desktop SoftwareEvidence1

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

catonetworksNews

Jun 10, 2026

Previously Undocumented NinjaOne RMM Abuse Chain| Cato Networks

A legitimate remote monitoring and management platform abused in this campaign to provide attacker-controlled remote access, persistence, reconnaissance, command execution, file transfer, scripting, and potential lateral movement.

ahnlab asec blogNews

Jan 22, 2026

Detection of Recent RMM Distribution Cases Using AhnLab EDR - ASEC

Legitimate cloud RMM platform; referenced as being abused/distributed in phishing-driven RMM tool abuse scenarios to enable remote monitoring/management capabilities on victim environments.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

NinjaOne

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

T1566.002Spearphishing LinkEvidence1

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

T1204User ExecutionEvidence1

T1204.002Malicious FileEvidence1

Persistence

2 techniques

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

T1136Create AccountEvidence1

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

Stealth

2 techniques

T1036MasqueradingEvidence1

The downloaded file was named NinjaOne-Agent-DocumentoFiscal21782856920262001238-Sede-Auto-x86-64, keeping the fiscal-document illusion alive right up to installation.

T1078Valid AccountsEvidence1

the operator used those recovered secrets to create and authenticate a rogue technician account within NinjaOne.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence2

Using that illicit NinjaOne access, the operator obtained remote access to a mix of servers, workstations, and domain controllers spanning several customer environments.

T1570Lateral Tool TransferEvidence1

The group leverages Impacket tools (wmiexec, smbexec, atexec), PsExec, and legitimate RMM software (AnyDesk, Level.io, NinjaOne) for lateral movement

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence2

This includes monitoring device activity, running remote commands, transferring files, deploying tools, and automating tasks, all through a trusted, digitally signed platform.

T1219Remote Access ToolsEvidence4

AnyDesk, NinjaOne, and Level.io are used for RMM persistence.

T1219.002Remote Desktop SoftwareEvidence1

Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

catonetworksNews

Jun 10, 2026

Previously Undocumented NinjaOne RMM Abuse Chain| Cato Networks

ahnlab asec blogNews

Jan 22, 2026

Detection of Recent RMM Distribution Cases Using AhnLab EDR - ASEC

Legitimate cloud RMM platform; referenced as being abused/distributed in phishing-driven RMM tool abuse scenarios to enable remote monitoring/management capabilities on victim environments.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.