{
  "family": "serveradmin",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\n\"Serveradmin\" is a generic detection classification for Riskware and dual-use Remote Administration Tools (RATs). This detection applies to commercial or legitimate remote access software (like VNC, TeamViewer, AnyDesk, or PsExec) when it is installed covertly, utilized without the user's knowledge, or deployed by an unauthorized party to maintain persistent, interactive access to a compromised system.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nBecause Serveradmin tools are technically legitimate software, they are often not blocked by default antivirus policies. Threat actors (Initial Access Brokers or APT groups) frequently deploy these tools *after* gaining initial access via exploiting vulnerabilities (e.g., in Exchange or RDP) or via phishing. \n\nUpon deployment, the tool provides \"living off the land\" capabilities:\n<ul>\n<li><strong>Covert Installation:</strong> The attacker installs the legitimate tool (e.g., AnyDesk) using command-line arguments to run silently, hide the system tray icon, and set a hardcoded unattended access password.</li>\n<li><strong>Interactive Remote Control:</strong> The tool provides the attacker with a fully functional, graphical desktop environment. They can interact with the system exactly as if they were sitting at the keyboard, bypassing many behavioral security detections.</li>\n<li><strong>Persistence and Evasion:</strong> Because the tool is signed by a legitimate software vendor, it easily bypasses application whitelisting (AppLocker). It establishes persistence by installing itself as a Windows Service, ensuring it starts automatically with system privileges.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of a Serveradmin tool is a critical security incident. It indicates that an adversary has established highly reliable, interactive remote access to the environment. This level of access is the immediate precursor to massive data exfiltration or the deployment of enterprise-wide ransomware.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Identify the Initial Vector:</strong> The presence of the RAT is a symptom, not the cause. Incident response must focus on *how* the attacker gained the privileges necessary to install the tool (e.g., compromised VPN credentials, unpatched external services).</li>\n<li><strong>Service Termination and Uninstallation:</strong> Immediately stop the associated Windows Service and uninstall the remote administration software. </li>\n<li><strong>Network Sweeps:</strong> Use EDR to hunt for instances of the specific remote admin tool (e.g., searching for `AnyDesk.exe` or `screenconnect`) across the entire enterprise to determine the scope of the lateral movement.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Riskware.RemoteAdmin",
    "Tool.RemoteAccess",
    "Win32/RemoteAdmin"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1219",
    "T1021.001",
    "T1569.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:54:00Z",
  "type": "Riskware / Remote Access Tool",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}