{
  "family": "remotemanipulator",
  "sample_count": 9,
  "category": "ransomware",
  "description": "HackTool:Win32/Remotemanipulator (commonly known as **RMS** or **Remote Manipulator System**) is a legitimate, commercial Remote Administration Tool (RAT) similar to TeamViewer or AnyDesk. While it is marketed as a legal IT support utility, RMS is heavily and aggressively abused by threat actors (including APTs and ransomware gangs) to establish persistent, high-privilege backdoors into corporate networks while blending in with legitimate administrative traffic.<br><br><b>Understanding RMS Abuse</b><br>To an end-user, RMS is largely invisible; threat actors deploy the 'Host' module silently without a GUI. For a security analyst, the unapproved presence of RMS is a critical incident. Because RMS is legally signed software (`T1553.002`), it routinely bypasses static antivirus signatures. Attackers use it to bypass network firewalls, utilizing the vendor's legitimate cloud relay servers to establish a reverse connection back to the attacker, eliminating the need for complex port forwarding.<br><br><b>Execution and Legitimate Tool Abuse</b><br>RMS is typically dropped as a secondary payload after initial access is gained via phishing (`T1566.001`) or RDP brute-forcing (`T1110`). Attackers deploy a customized, pre-configured MSI installer of the RMS Host module. They use command-line switches to install it silently (`T1059.004`), hiding the tray icon and disabling user prompts. Once installed, it establishes persistence as a high-privilege Windows Service (`T1543.003`). The host connects out to the legitimate RMS infrastructure (often `tektonit.ru` or associated IPs) (`T1071.001`). The attacker connects to the same infrastructure using the 'Viewer' module, granting them full GUI control, file transfer (`T1041`), and command execution capabilities on the victim machine, completely bypassing perimeter ingress filtering.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive remote control of the endpoint, almost always preceding lateral movement or data exfiltration. The primary IoC is the execution of `rutserv.exe` or `rfusclient.exe` (the core RMS binaries), especially if launched silently from a temporary directory. Network analysts should look for sustained outbound TCP traffic to known RMS relay servers. EDR logs will flag the silent installation of the 'Remote Manipulator System' service.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1543.003",
    "T1219",
    "T1553.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Abusing legitimate RMS for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (RMS Host Service)",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol (Using RMS cloud relays for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1553.002",
      "name": "Subvert Trust Controls: Code Signing (RMS is digitally signed)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; active RMS traffic indicates an attacker is currently 'hands-on-keyboard' in the network.",
    "Use the Windows Service Manager (services.msc) or EDR to forcefully stop and disable the 'Remote Manipulator System' service.",
    "Block all known RMS relay domains and IP addresses at the enterprise firewall to sever the attacker's connection.",
    "Perform a deep forensic review; if RMS is present, the attacker has already gained initial access and likely dumped local credentials."
  ],
  "what_to_avoid": [
    "Do not assume the software is benign just because it is digitally signed or classified as a 'HackTool' rather than a Trojan; in the hands of an attacker, it is a devastating backdoor.",
    "Avoid closing the incident simply by uninstalling RMS; you must investigate *how* the attacker deployed it in the first place."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}