{
  "family": "remoteadmin",
  "sample_count": 95,
  "category": "ransomware",
  "description": "Program:Win32/Remoteadmin is a broad classification for dual-use, commercially available Remote Administration Tools (RATs)—such as AnyDesk, TeamViewer, or Ammyy Admin—that are actively and aggressively abused by threat actors to establish persistent, interactive access to compromised networks.<br><br><b>Understanding Remoteadmin</b><br>For the end-user, these tools may be familiar IT support applications. For a security analyst, unauthorized 'Remoteadmin' tools represent a critical security incident. Threat actors (including ransomware operators and APTs) frequently utilize legitimate commercial RATs because their network traffic is generally trusted by firewalls, and the binaries themselves are digitally signed and rarely flagged by legacy antivirus, providing a perfect 'Living off the Land' (LotL) evasion technique.<br><br><b>Execution and Threat Hunting</b><br>Attackers typically deploy Remoteadmin tools after gaining initial access via phishing or exploiting perimeter vulnerabilities (like exposed RDP). They silently install the tool (e.g., executing AnyDesk with hidden command-line parameters), configure it for unattended access with a custom password, and establish persistence via a Windows Service. This grants the attacker a highly stable, GUI-based backdoor into the network, allowing them to bypass EDR detections that would otherwise flag custom-built malware backdoors.<br><br><b>Forensic Analysis & Impact</b><br>The impact is total, interactive endpoint compromise. Incident responders must hunt for unauthorized installations of commercial RATs. EDR platforms should be configured to flag the execution of these tools outside of the approved IT support department. Network logs will show sustained, outbound connections to the infrastructure of the commercial RAT provider (e.g., `*.anydesk.com`). Analysts must investigate the configuration files of the deployed RAT to identify the attacker's client ID and connection timestamps.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1219",
    "T1543.003",
    "T1078",
    "T1071.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactic": "Command and Control"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the attacker's interactive, GUI-based remote access session.",
    "Identify the specific Remoteadmin tool utilized (e.g., TeamViewer, ScreenConnect) and uninstall the software and its associated Windows Services.",
    "Review the specific tool's log files (often found in `%AppData%` or `%ProgramData%`) to determine the duration of the unauthorized access and the attacker's origin IP.",
    "Implement application whitelisting (e.g., AppLocker) to strictly block the execution of unapproved commercial remote access tools enterprise-wide."
  ],
  "what_to_avoid": [
    "Do not assume the presence of a commercial RAT is legitimate IT activity without explicit verification from the support desk.",
    "Avoid merely stopping the service; the attacker will have likely used the interactive access to deploy secondary backdoors (like Cobalt Strike)."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}