Loading story…
Initial access brokers advertised and sold access to dozens of organizations through Zoho ManageEngine Desktop Central, turning a legitimate remote monitoring and management platform into a high-value entry point for ransomware operations. KELA tracked 53 access listings between July and September 2020 with a combined asking price of $153,850, and said at least 10 had already been sold. Victims spanned multiple countries and sectors, including government organizations, while some of the highest-priced listings were tied to companies in Turkey and Canada. Researchers assessed that the compromises were more likely caused by direct attacks against exposed Desktop Central instances and the use of valid credentials than by a single managed service provider breach.
The sales fit a broader underground market in which brokers monetized enterprise footholds for follow-on attacks, including ransomware deployment. KELA later counted 242 network access listings worth about $1.21 million in Q4 2020, with common offerings including RDP, VPN, Citrix, RCE, and increasingly RMM-based access. The appeal of Desktop Central was its ability to provide remote control and script execution across many endpoints, enabling rapid domain-wide compromise; a separate DFIR case involving NetWalker showed how quickly ransomware operators could move from initial access to full encryption. Zoho said weak credentials were the likely cause in the investigated Desktop Central cases and moved to block future logins using weak passwords.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On December 4, 2020, the LockBit ransomware blog claimed to have compromised Mexico's National Insurance and Surety Commission and demanded a $1 million ransom. KELA assessed the previously advertised access may have been sold to LockBit or handled by a LockBit affiliate.
In late November 2020, a threat actor advertised access to Mexico's National Insurance and Surety Commission with a starting auction price of $70,000 and a buy-now price of $100,000. KELA assessed the access could have been intended for ransomware use.
In September 2020, KELA observed the broker advertising 36 additional accesses via Zoho ManageEngine Desktop Central on a Russian-speaking underground forum. KELA assessed the actor offered 53 accesses across July and September 2020 with a combined asking value of $153,850, and at least 10 had already been sold.
KELA said the same initial access broker offered about a dozen unauthorized accesses tied to Zoho ManageEngine Desktop Central in July 2020. These listings were part of a broader campaign selling access to organizations across multiple countries and sectors.
The content notes that CVE-2020-10189 in ManageEngine Desktop Central was reported as exploited in March 2020 to install malware. This is cited as prior abuse of the product, though KELA assessed the later access-sales activity was likely unrelated.
After KELA shared victim information with Zoho, Zoho's information security team investigated and concluded that weak credentials used on ManageEngine products were the likely cause of the compromises under review. KELA's later Q4 report cited this conclusion in connection with the actor 'pshmm.'
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat reporting shows legitimate remote administration and monitoring tools being repeatedly repurposed for intrusion, persistence, and ransomware deployment. Walmart Global Tech highlighted abuse of **RemotePC**, **UltraViewer**, **MSP360**, **PDQ Deploy**, and **Zoho Assist**, noting their use for remote control, lateral movement, script execution, phishing-enabled access, and data theft; the report tied **UltraViewer** to **FatalRAT** activity and linked **Zoho** tooling to broader exploitation trends, including `CVE-2021-40539` in ManageEngine environments. Separately, KELA documented an initial access broker selling access to 53 organizations through **Zoho ManageEngine Desktop Central**, with victims spanning multiple countries and sectors, including government entities, and assessed that direct compromise or credential abuse was more likely than a managed service provider breach.
Aug 15, 2026
Attackers leveraged trusted remote management software in two separate supply chain intrusions, including a ransomware case tied to **Kaseya VSA** and a credential-dumping operation delivered through a **Desktop Central** agent. In the Kaseya-linked incident, the intrusion chain used the Kaseya agent to create and decode malicious payloads, attempted to disable Microsoft Defender protections, and dropped ransomware-related components including `agent.exe` and `MsMpEng.exe`. In the second intrusion, the attackers used the Desktop Central agent to gain footholds, established persistence with scheduled tasks, forwarded traffic with **GO Simple Tunnel**, and deployed `setup0.exe` alongside `elevateutils.exe`, which analysis identified as a **Cobalt Strike Beacon** Malleable C2 stager communicating with `vmware[.]center`. Investigators contained the activity through root-cause analysis, IOC hunting, and endpoint isolation, underscoring how centralized management platforms can become high-impact supply chain attack vectors if not closely monitored and hardened.
Aug 14, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026