Loading story…
Huntress reported a phishing campaign that used malspam emails and fake document download pages with CAPTCHA-themed lures to deliver a signed Tiflux MSI installer, giving attackers remote access and persistence on victim systems. The installer, tied to a Brazil-originated remote monitoring and management product, was used to deploy additional remote access software including Splashtop, ScreenConnect, and bundled UltraVNC components, expanding the operators’ ability to control compromised hosts.
Investigators said the installer included several suspicious and outdated elements, including obsolete UltraVNC files, multiple registry modification files, hardcoded credentials, and the vulnerable HwRwDrv.x64 driver linked to privilege escalation. In observed intrusions, the tooling supported screenshot capture, system profiling, operating system interrogation, and in some cases unauthorized access and credential theft; Huntress also identified related infrastructure, including malicious domains, payload URLs, and a ScreenConnect server at 84.54.33[.]192:8040, describing the activity as part of a broader LOLRMM trend in which threat actors misuse legitimate remote management tools for stealthy access.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Huntress disclosed the campaign and reported that the installer contained outdated and suspicious components, including obsolete UltraVNC files, registry modification files, hardcoded credentials, and the vulnerable HwRwDrv.x64 driver. The company also published related infrastructure and file hashes, including malicious domains, payload URLs, and a ScreenConnect server at 84.54.33[.]192:8040.
In observed intrusions, the Tiflux MSI subsequently deployed or enabled additional remote access tools including Splashtop, ScreenConnect, and bundled UltraVNC components. The combined tooling supported actions such as screenshot capture, system profiling, operating system interrogation, and in some cases unauthorized access and credential theft.
Threat actors conducted a phishing-driven campaign using malspam emails and fake document download pages with CAPTCHA-themed lures to deliver a signed Tiflux MSI installer. The installer was used to gain remote access and persistence on victim systems as part of a LOLRMM-style intrusion chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Huntress investigated three phishing-led intrusions in which attackers abused legitimate remote monitoring and management (RMM) tools to gain persistent access. One campaign used a TransferXL-hosted ZIP archive and malicious PDF lure to prompt installation of **ITarian**, then deployed **ScreenConnect**; two others used fraudulent document-sharing emails branded as ScreenConnect to install multiple ScreenConnect clients. The attackers configured rogue RMM agents for `SYSTEM`-level persistence, created redundant remote-access channels, and used defense-evasion tooling including `HideUL_x64.exe`. Huntress reported RMM abuse rose **277%** during 2025 and appeared in nearly 40% of incidents investigated by its Tactical Response team, underscoring the need to restrict, inventory, and monitor authorized remote-management software.
Sep 23, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware. The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included `fmtt` font files, `font1.woff2`, `icons8-microsoft-word-94.png`, and a `secure.html`-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Aug 26, 2026