Using portable executables of RMM software provides a way for actors to establish local user access without the need for administrative privilege and full software installation-effectively bypassing common software controls and risk management assumptions. This campaign highlights the threat of malicious cyber activity associated with legitimate RMM software: after gaining access to the target network via phishing or other techniques, malicious cyber actors-from cybercriminals to nation-state sponsored APTs-are known to use legitimate RMM software as a backdoor for persistence and/or command and control (C2). For example, the actors could sell victim account access to other cyber criminal or advanced persistent threat (APT) actors. Specifically, cyber criminal actors sent phishing emails that led to the download of legitimate RMM software-ScreenConnect (now ConnectWise Control) and AnyDesk-which the actors used in a refund scam to steal money from victim bank accounts.Īlthough this campaign appears financially motivated, the authoring organizations assess it could lead to additional types of malicious activity. In October 2022, CISA identified a widespread cyber campaign involving the malicious use of legitimate RMM software.

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Multi-State Information Sharing and Analysis Center (MS-ISAC) (hereafter referred to as the “authoring organizations”) are releasing this joint Cybersecurity Advisory (CSA) to warn network defenders about malicious use of legitimate remote monitoring and management (RMM) software.

Anydesk for windows 10 latest version