Loading story…
A newly tracked AgtaBackup .NET remote-access trojan campaign uses counterfeit Microsoft Store-themed pages advertising video-conferencing software to trick Windows users into installing legitimate, signed remote monitoring and management tools, notably LogMeIn Resolve and ConnectWise ScreenConnect. After victims approve a UAC prompt, their endpoints are enrolled into attacker-controlled RMM tenants, giving operators initial remote access before they download and silently install AgtaBackup as a concealed service with SYSTEM privileges.
AgtaBackup steals browser credentials and cookies, logs keystrokes, captures screenshots, transfers files, and provides interactive shell and PowerShell execution; it can also execute commands through a hidden desktop and supports UAC-bypass capabilities. Persistence is maintained through a service and watchdog scheduled tasks, including SYSTEM tasks configured to recover at one-minute intervals, while command-and-control uses frequent check-ins and WebSocket commands. Defenders should investigate unauthorized RMM enrollments, fake software-download referrals, suspicious PowerShell-driven installs, newly created SYSTEM services and scheduled tasks, and the published campaign domains, hashes, API paths, and telemetry queries.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 identified a Windows .NET remote-access trojan campaign using counterfeit Microsoft Store-style and video-conferencing pages to induce victims to install signed LogMeIn Resolve or ConnectWise ScreenConnect RMM software. Attackers then use the RMM access to deploy AgtaBackup RAT with SYSTEM privileges, enabling persistence, browser-data theft, keylogging, surveillance, and remote command execution.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Operation BlueDash** is using Microsoft Teams-themed phishing lures to trick users into installing legitimate remote monitoring and management (**RMM**) software, giving attackers persistent remote access while blending into normal enterprise administration. Victims are redirected through compromised infrastructure to a fake Microsoft Store page at `teamvem[.]com`, where an Inno Setup loader named `supportdev.exe` launches hidden PowerShell to retrieve and register **Level RMM** and, in some cases, **ConnectWise ScreenConnect**. Investigators linked the activity with moderate-to-high confidence to a Nigeria-based threat actor and identified supporting GitHub infrastructure, including the `Bluedashltd` repository and `berry4603.github[.]io`, indicating the campaign has been active since at least February 2026. The campaign reflects a broader pattern in which adversaries abuse legitimate RMM tools because they provide powerful remote administration capabilities and can evade scrutiny in environments where such software is common. Security researchers have previously highlighted sustained abuse of tools such as **NetSupport Manager**, **Atera**, **Remote Utilities**, and **Remcos**, with groups including **SCATTERED SPIDER** using multiple RMM platforms for lateral movement and hands-on-keyboard operations. In the BlueDash activity, operators were also seen conducting host reconnaissance after access, and related infrastructure supported a parallel Zoom-themed lure chain delivering **Tactical RMM**, underscoring how attackers are using trusted remote-access software and multi-brand social engineering to maintain access and complicate detection.
Jul 27, 2026
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware. The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included `fmtt` font files, `font1.woff2`, `icons8-microsoft-word-94.png`, and a `secure.html`-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Aug 26, 2026
Threat researchers reported multiple phishing-driven intrusions in which attackers impersonate trusted brands and agencies to trick victims into installing legitimate remote monitoring and management (RMM) software for persistent access. In **Operation DoppelBrand**, financially motivated actor **GS7** spoofed Fortune 500 financial and technology brands (including **Wells Fargo** and **USAA**) using more than **150** lookalike domains to harvest credentials and exfiltrate data via attacker-controlled **Telegram bots**; researchers also identified nearly **200** additional domains with short registration terms, automated SSL, wildcard DNS, and brand-specific subdomains supporting the campaign. Separately, Forcepoint X-Labs described a wave of emails impersonating the **U.S. Social Security Administration** that delivers an attached `.cmd` script to weaken Windows defenses and enable silent installation of **ConnectWise ScreenConnect**. The script checks/elevates privileges, disables **Windows SmartScreen** via registry changes, removes **Mark-of-the-Web**, and uses **Alternate Data Streams (ADS)** for stealth before installing an MSI and configuring ScreenConnect (via `System.config`) to beacon to an attacker-controlled server (reported as `dof-connecttop` on port `8041`). Both activity sets highlight a recurring tradecraft pattern: **brand impersonation + scripted defense evasion + abuse of legitimate RMM tooling** (e.g., *LogMeIn Resolve*, *ScreenConnect*) to gain remote control and facilitate follow-on theft or persistence.
Jun 29, 2026