TrustConnect
TrustConnect is a malware-as-a-service (MaaS) remote access trojan (RAT) masquerading as a legitimate remote monitoring and management (RMM) tool (“TrustConnect Agent”). It was marketed via an LLM-created fake vendor website/portal on trustconnectsoftware[.]com (claiming to be “TrustConnect Software PTY LTD”), which also functioned as the criminal signup portal and the malware’s command-and-control (C2) infrastructure. The service was advertised at $300/month, with customers instructed to pay in cryptocurrency and verify payment via transaction hash; signup included OTP verification via Zoho transactional email integration.
Distribution was observed via phishing email campaigns using common business lures (e.g., taxes, DocuSign/document shares, meeting invitations, event invites, bid proposals, and government-themed content), including English and French messages sent from compromised senders. Phishing links delivered bogus executables (e.g., “MsTeams.exe” and other branded installers mimicking Zoom, Microsoft Teams, Adobe Reader, Google Meet, and document-style filenames like “Proposal,” “Special Events,” “Social Security Administrative”) that installed/dropped TrustConnectAgent.exe, which then communicated with the TrustConnect C2.
Capabilities described include a web-based multi-tenant C2/dashboard with automated payload generation and centralized management, command execution, file transfer, system information viewing, and remote desktop control. The remote desktop feature supported full mouse/keyboard control, screen recording/streaming, multi-display switching, UAC bypass, and hiding operator activity; streaming was reported to use an unauthenticated WebSocket. TrustConnect malware traffic used standard SSL/TLS without additional encryption and communicated with the same API as the web panel.
Operationally, Proofpoint observed hands-on-keyboard activity within minutes of installation and assessed TrustConnect was used by multiple threat actors. Infections were frequently followed by deployment of legitimate remote access tools (notably ScreenConnect; also LogMeIn Resolve and Level RMM were observed). ScreenConnect deployments were seen from at least nine distinct self-hosted servers over a 10-day period, using older versions signed with expired/revoked certificates.
The operator obtained an Extended Validation (EV) code-signing certificate in the name of “TrustConnect Software PTY LTD” (purportedly Alexandra, South Africa) and used it to sign TrustConnect binaries to reduce detection; the certificate was revoked on 6 Feb 2026 (revocation not backdated, so previously signed files remained valid). Proofpoint coordinated disruption of TrustConnect infrastructure around 17 Feb 2026, after which the operator pivoted to parallel infrastructure and a rebranded successor platform/payload called DocConnect (also referenced as “SHIELD OS v1.0”), with C2 noted as networkservice[.]cyou. Proofpoint assessed with moderate confidence that the TrustConnect actor was also a prominent RedLine Stealer user/customer.
High-confidence indicators mentioned: trustconnectsoftware[.]com (TrustConnect C2/portal), 178[.]128[.]69[.]245 (TrustConnect C2 IP), networkservice[.]cyou (DocConnect C2 domain), and Telegram handle @zacchyy09 (listed for support/sales in the panel).
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
“observed deployment of Level RMM via an abused account… (We reported it to Level, and the account was disabled by the vendor.)”
“Messages contained URLs leading to an executable file ‘MsTeams.exe’… [which] dropped a file called ‘TrustConnectAgent.exe’…” and “Threat actors distributing TrustConnect have used a variety of lure themes including taxes, document shares, meeting invitations, events, and government themes.”
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Defense Impairment
1 technique
Defense Impairment
Lateral Movement
1 technique
Lateral Movement
Command and Control
3 techniques
Command and Control
“The malware communicates with the C2 on the same API as the web panel and doesn’t use any additional encryption other than standard SSL/TLS… POST /api/agents/register… GET /api/agent-commands/”
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan sold as a service while masquerading as legitimate RMM software.
Malware-as-a-service posing as a legitimate RMM tool, providing remote access capabilities; infrastructure disruption noted with subsequent re-emergence under a related brand.
Malware-as-a-Service operation distributing a RAT while masquerading as a legitimate RMM tool; linked by Proofpoint to a former RedLine user.
A remote access trojan (RAT) masquerading as legitimate remote monitoring and management (RMM) software, sold as a service with a web portal that functions as both customer signup/payment verification and malware C2. Delivered via email lures and signed with an EV certificate to evade signature-based detection; observed leading to follow-on deployment of legitimate remote access tools (e.g., ScreenConnect) and hands-on-keyboard activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.