Loading story…
AhnLab’s ASEC reported phishing campaigns distributing legitimate remote monitoring and management (RMM) tools, including ConnectWise ScreenConnect, FleetDeck, Datto RMM, SimpleHelp, JumpCloud, and N-able. Attackers used document-themed attachments, PDF links, phishing pages, and scripts to persuade users to install agents configured for attacker-controlled remote access. The report identifies deployment identifiers, configuration fields, and associated infrastructure that can support detection. Because these tools also serve legitimate administrative purposes, malicious installations can complicate security monitoring and blocking. ASEC did not attribute the newly identified campaigns to a specific threat actor.
Separate government advisories illustrate how remote-access capabilities fit into ransomware intrusions, without establishing a connection to these phishing campaigns. The FBI, CISA, and HHS documented ALPHV/BlackCat affiliates using social engineering, remote-access and tunneling tools, credential theft, and cloud-based data exfiltration; healthcare was the most frequently victimized sector among nearly 70 leaked victims after mid-December 2023. An updated Play ransomware advisory reported approximately 900 allegedly affected entities known to the FBI as of May 2025 and described access through valid accounts and vulnerable public-facing applications, including activity exploiting SimpleHelp vulnerability CVE-2024-57727. Defenders should scrutinize unexpected RMM installations and their deployment configurations, secure remote access with phishing-resistant MFA, rapidly patch exploited vulnerabilities, segment networks, and maintain offline or immutable backups.
Get the infrastructure and lures behind it.
17 events from the most recent confirmed update back to the earliest known activity.
In the second half of 2026, ScreenConnect was distributed through LNK, BAT, and VBS files with filenames suggesting phishing email attachments. Examples impersonated a Dropbox shared PDF, a Zoom installer, and a wire receipt.
ASEC reported attackers distributing Syncro, ConnectWise ScreenConnect, NinjaOne, and SuperOps through video files and phishing email attachments.
The FBI, CISA, and ACSC updated the Play ransomware advisory with newly observed tactics and refreshed indicators, removing outdated indicators and adding current ones. The update incorporated FBI investigative findings through January 2025.
By May 2025, the FBI was aware of approximately 900 affected entities allegedly exploited by Play ransomware actors.
CVE-2024-57727 in SimpleHelp remote monitoring and management software was disclosed. The Play advisory subsequently linked post-disclosure exploitation to multiple ransomware groups and initial access brokers with ties to Play operators.
The FBI, CISA, and HHS updated the ALPHV/BlackCat advisory with investigative findings observed through February 2024, including victim-specific notification emails and updated indicators. The update reported that healthcare had been the most commonly victimized sector among nearly 70 leaked victims since mid-December 2023.
The initial version of the joint #StopRansomware cybersecurity advisory on ALPHV/BlackCat was published, expanding on the FBI's earlier FLASH report.
The FBI, CISA, and Australia's ACSC published a joint #StopRansomware advisory covering Play ransomware and its associated indicators and tactics.
Operational action was taken against the ALPHV/BlackCat group and its infrastructure in early December 2023.
A further Play ransomware incident was observed in Australia in November 2023.
The first observed Play ransomware incident in Australia occurred in April 2023.
ALPHV/BlackCat administrators announced “ALPHV Blackcat Ransomware 2.0 Sphynx,” a rewritten version with improved defense evasion and additional tooling. The update supports encryption of Windows and Linux devices and VMware instances.
Play ransomware activity began affecting businesses and critical infrastructure across North America, South America, and Europe.
The FBI released its FLASH report, “BlackCat/ALPHV Ransomware Indicators of Compromise,” documenting indicators associated with the ransomware operation.
ASEC documented phishing cases installing FleetDeck, Datto RMM, SimpleHelp, JumpCloud, and N-able through PDF links, Adobe-themed pages, HTML scripts, and a DocuSign-themed lure. The report disclosed deployment identifiers, agent configuration details, and infrastructure indicators without attributing the newly identified cases to a specific threat actor.
After disclosure of CVE-2024-57727, multiple ransomware groups, including initial access brokers with ties to Play operators, exploited the vulnerability to achieve remote code execution using PowerShell.
Following the operational action against ALPHV, an administrator posted encouragement for affiliates to target hospitals. The subsequent federal advisory assessed that this likely influenced increased healthcare targeting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 76 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign active since January 2026 has targeted victims in 46 countries—45% of observed activity involved the United States—using tax forms, Social Security notices, invoices, VAT, shipping, Adobe PDF, and shared-file lures. Victims are sent to short-lived pages hosted on services including Vercel, Netlify, Amazon S3, and DigitalOcean Spaces, or on compromised sites, then prompted to download password-protected ZIP archives. The archives use a VBS-to-PowerShell chain to retrieve signed installers for legitimate remote monitoring and management (RMM) products, giving operators interactive access without relying on conventional malware. The operators rotate among GoTo Resolve, LogMeIn Rescue, ScreenConnect, ConnectWise, and ITarian, limiting the value of product-specific blocking. Researchers identified 425 delivery-kit URLs across 240 hosts between February 5 and July 29, with 94% of hosts remaining live for only one day; stable kit artifacts included `fmtt` font files, `font1.woff2`, `icons8-microsoft-word-94.png`, and a `secure.html`-to-ZIP delivery chain. Organizations should detect and investigate unauthorized RMM deployments, particularly script-initiated PowerShell downloads of MSI installers, newly installed support software, and password-protected ZIP files delivered through phishing pages.
Aug 26, 2026
Threat reporting has highlighted phishing-led intrusions in which attackers use legitimate remote monitoring and management (RMM) software to gain and retain access to victim environments. The approach can obscure malicious activity within approved administrative tooling, creating a material visibility gap for security teams and enabling adversaries to operate without deploying obviously malicious remote-access malware. The activity includes a U.S.-targeted phishing campaign and broader organized-cybercrime tradecraft that pair social engineering with RMM abuse. Organizations should treat unexpected RMM installation, new unattended-access configurations, and remote-control sessions initiated after phishing activity as high-priority signals; enforce application allowlisting and least privilege for RMM tools; and require strong authentication, centralized logging, and alerting for all remote-management access.
Sep 9, 2026
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026