Loading malware…
Remote Manipulator System (RMS) is a legitimate remote administration product developed by the Russian company TektonIT that threat actors abuse as a remote access tool. It supports remote desktop control and sharing, command execution through terminal access, file transfers, network mapping, webcam and microphone access, encrypted remote desktop connections, and RDP integration. The product supports Windows and Android, while documented malicious deployments primarily involve Windows systems. Connectivity can use developer-hosted Internet-ID services or self-hosted relay infrastructure.
Malicious deployments commonly install attacker-configured RMS through multistage scripts and Windows Installer packages. Distribution methods include spear-phishing emails with weaponized Word or Excel attachments, links to nested archives, and executables disguised as documents. RMS has also been bundled with Ovidiy Stealer in a cryptocurrency-software lure. Observed installations establish persistence through logon autorun entries. Abuse of legitimately signed software and unattended installation helps attackers maintain access while reducing the visibility of their activity.
RMS has been used by TA505, UAC-0050, and other unrelated threat actors. Campaigns have targeted US retailers, food and beverage organizations, financial institutions across several countries, and Ukrainian organizations. UAC-0050 has used RMS alongside other remote access tools to compromise accountants’ computers and conduct fraudulent payments through remote banking systems. RMS has also been deployed against a European financial institution involved in regional development and reconstruction, and as an auxiliary remote access tool in a cryptomining campaign. Its legitimate functionality enables reconnaissance, remote command execution, and data transfer without requiring a purpose-built malicious implant.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Remote Manipulator System (RMS) is a legitimate remote administration tool developed by a Russian organization ‘TektonIT’ and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors.
These attachments relied on a multi-stage execution chain, often using up to three nested stages, to download and execute off-the-shelf payloads like Remote Manipulator System (RMS) RAT.
This was the first time Proofpoint observed UAC-0050 deliver NetSupport, as it has historically used other malware including Remcos and Lumma Stealer, but it has previously used RMMs including Litemanager and Remote Manipulator System (RMS).
"The execution results in the deployment of an MSI installer for Remote Manipulator System (RMS), a Russian remote desktop software that allows remote control, desktop sharing, and file transfers."
1 distinct technique documented for this family, organized by ATT&CK tactic.
Using legitimate tools and settings to persist versus malware implants such as Cobalt Strike is a popular technique among ransomware attackers to avoid detection and remain resident in a network for longer. Some of the common enterprise tools and techniques for persistence that Microsoft has observed being used include: AnyDesk, Atera Remote Management, ngrok.io, Remote Manipulator System, Splashtop, TeamViewer.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.