Malware

ManageEngine Endpoint Central

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

WhatsApp accounts were hijacked to spread fake debt notices that install remote access software, giving attackers control of victims’ PCs.

T1566.001Spearphishing AttachmentEvidence1

The attack starts with WhatsApp messages sent from compromised accounts. These messages typically contain only a heavily obfuscated VBScript file designed to evade detection.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1059.005Visual BasicEvidence1

Once executed, the VBScript initiates a multi-stage infection chain that ultimately results in the installation of legitimate Remote Monitoring and Management (RMM) software.

T1204.002Malicious FileEvidence2

Once a victim downloads and executes the attachment, a multi-stage infection process begins.

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1112Modify RegistryEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections and retrieve a ZIP archive containing ManageEngine Endpoint Central.

Privilege Escalation

5 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1484.001Group Policy ModificationEvidence2

Finally, in mid-May, the attackers managed to execute a Group Policy Object (GPO) used to deploy activation and encryption tasks, as well as other policies responsible for continued deployment of RMM applications via scheduled tasks.

T1548Abuse Elevation Control MechanismEvidence1

The command is launched using the ShellExecute method with the runas verb, causing Windows to request administrative privileges before the registry change can be applied.

T1548.002Bypass User Account ControlEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections

Stealth

1 technique

T1218.007MsiexecEvidence3

Once extracted and executed, this package installs itself silently using Windows Installer and connects back to attacker-controlled servers.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections and retrieve a ZIP archive containing ManageEngine Endpoint Central.

T1484.001Group Policy ModificationEvidence2

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

The setup script installs it silently so the user sees nothing, then connects the newly installed agent to attacker-controlled management servers.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence5

If a Windows user opens the malicious file, the VBScript downloads two additional scripts from attacker-controlled servers.

T1219Remote Access ToolsEvidence8

In early May, the attackers focused on running additional scans and deploying ManageEngine’s Endpoint Central RMM (Remote Monitoring and Management) to establish persistence... Further RMM-type applications, such as Mesh Agent and Tactical RMM, were installed in the days that followed.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware newsNews

Jun 22, 2026

A VBScript campaign distributed through WhatsApp deploying RMM software - Malware News - Malware Analysis, News and Indicators

A legitimate remote monitoring and management platform abused in this campaign to gain persistent remote access on victim systems via silent installation of the Endpoint Central agent.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

ManageEngine Endpoint Central

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

WhatsApp accounts were hijacked to spread fake debt notices that install remote access software, giving attackers control of victims’ PCs.

T1566.001Spearphishing AttachmentEvidence1

The attack starts with WhatsApp messages sent from compromised accounts. These messages typically contain only a heavily obfuscated VBScript file designed to evade detection.

Execution

4 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1059.005Visual BasicEvidence1

Once executed, the VBScript initiates a multi-stage infection chain that ultimately results in the installation of legitimate Remote Monitoring and Management (RMM) software.

T1204.002Malicious FileEvidence2

Once a victim downloads and executes the attachment, a multi-stage infection process begins.

Persistence

3 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1112Modify RegistryEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections and retrieve a ZIP archive containing ManageEngine Endpoint Central.

Privilege Escalation

5 techniques

T1053Scheduled Task/JobEvidence1

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks...

T1053.005Scheduled TaskEvidence2

These were used to deploy scheduled tasks responsible for enabling the BitLocker service and individually encrypting the infrastructure’s disks, generating a key for each encrypted system.

T1484.001Group Policy ModificationEvidence2

T1548Abuse Elevation Control MechanismEvidence1

The command is launched using the ShellExecute method with the runas verb, causing Windows to request administrative privileges before the registry change can be applied.

T1548.002Bypass User Account ControlEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections

Stealth

1 technique

T1218.007MsiexecEvidence3

Once extracted and executed, this package installs itself silently using Windows Installer and connects back to attacker-controlled servers.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

These scripts modify the Windows Registry to disable User Account Control (UAC) protections and retrieve a ZIP archive containing ManageEngine Endpoint Central.

T1484.001Group Policy ModificationEvidence2

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

The setup script installs it silently so the user sees nothing, then connects the newly installed agent to attacker-controlled management servers.

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence5

If a Windows user opens the malicious file, the VBScript downloads two additional scripts from attacker-controlled servers.

T1219Remote Access ToolsEvidence8

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware newsNews

Jun 22, 2026

A VBScript campaign distributed through WhatsApp deploying RMM software - Malware News - Malware Analysis, News and Indicators

A legitimate remote monitoring and management platform abused in this campaign to gain persistent remote access on victim systems via silent installation of the Endpoint Central agent.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.