#rmm — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #rmm, aggregated by home.social.
-
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #opensource #tacticalrmm #reverseproxy #letsencrypt #redis #postgresql #certbot #remotedesktopprotocol #selfhosting #rabbitmq #nodejs #selfhosted
Deploy Tactical RMM on Debian ... -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #opensource #tacticalrmm #reverseproxy #letsencrypt #redis #postgresql #certbot #remotedesktopprotocol #selfhosting #rabbitmq #nodejs #selfhosted
Deploy Tactical RMM on Debian ... -
-
🕵️ Nouvel article #CTI Stormshield : quand le #phishing rencontre le détournement d'outils #RMM. Découvrez les coulisses d'une attaque usurpant #DocuSign pour infiltrer les systèmes et installer des outils légitimes à des fins malveillantes.
➡️ https://www.stormshield.com/fr/actus/cti-campagne-phishing-installation-rmm/cti-phishing-campaign-rmm-installation/?at_medium=social&at_campaign=cti-content&at_platform=Mastodon #ThreatIntel #cybersécurité
-
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #postgresql #reverseproxy #opensource #tacticalrmm #letsencrypt #nodejs #selfhosted #remotedesktopprotocol #redis #rabbitmq #selfhosting #certbot -
Don’t worry Kaseya, I’ll just have to do a few extra steps to make this workflow work because of your “security features”. LOL.
-
Don’t worry Kaseya, I’ll just have to do a few extra steps to make this workflow work because of your “security features”. LOL.
-
Don’t worry Kaseya, I’ll just have to do a few extra steps to make this workflow work because of your “security features”. LOL.
-
Don’t worry Kaseya, I’ll just have to do a few extra steps to make this workflow work because of your “security features”. LOL.
-
Don’t worry Kaseya, I’ll just have to do a few extra steps to make this workflow work because of your “security features”. LOL.
-
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #nodejs #rabbitmq #opensource #letsencrypt #reverseproxy #redis #certbot #tacticalrmm #postgresql #selfhosting #selfhosted #remotedesktopprotocol -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #nodejs #rabbitmq #opensource #letsencrypt #reverseproxy #redis #certbot #tacticalrmm #postgresql #selfhosting #selfhosted #remotedesktopprotocol -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #opensource #redis #reverseproxy #selfhosted #letsencrypt #nodejs #selfhosting #remotedesktopprotocol #postgresql #rabbitmq #tacticalrmm #certbot
Deploy Tactical RMM on Debian ... -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #opensource #redis #reverseproxy #selfhosted #letsencrypt #nodejs #selfhosting #remotedesktopprotocol #postgresql #rabbitmq #tacticalrmm #certbot
Deploy Tactical RMM on Debian ... -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #redis #opensource #rabbitmq #postgresql #reverseproxy #tacticalrmm #remotedesktopprotocol #selfhosted #certbot #nodejs #letsencrypt #selfhosting
Deploy Tactical RMM on Debian ... -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on ...
Continued 👉 #redis #opensource #rabbitmq #postgresql #reverseproxy #tacticalrmm #remotedesktopprotocol #selfhosted #certbot #nodejs #letsencrypt #selfhosting
Deploy Tactical RMM on Debian ... -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #tacticalrmm #postgresql #rabbitmq #selfhosting #redis #letsencrypt #opensource #certbot #selfhosted #reverseproxy #nodejs #remotedesktopprotocol -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.raddemo.host #tacticalrmm #postgresql #rabbitmq #selfhosting #redis #letsencrypt #opensource #certbot #selfhosted #reverseproxy #nodejs #remotedesktopprotocol -
Deploy Tactical #RMM on #Debian #VPS
This article provides a guide for how to run a self-hosted RMM, when you deploy Tactical RMM on Debian VPS server.
Tactical RMM (TRMM) is a powerful open-source Remote Monitoring and Management (RMM) platform designed for Managed Service Providers (MSPs), IT departments, and ...
Continued 👉 https://blog.radwebhosting.com/deploy-tactical-rmm-on-debian-vps/?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon.social #certbot #postgresql #letsencrypt #opensource #nodejs #selfhosted #reverseproxy #selfhosting #tacticalrmm #rabbitmq #redis #remotedesktopprotocol -
VBScript via WhatsApp: documenti aziendali falsi installano ManageEngine RMM in campagna globale con tracce cinesi
Kaspersky documenta una campagna malware attiva in 11 Paesi che usa WhatsApp per distribuire VBScript offuscati camuffati da documenti aziendali. Il payload finale è ManageEngine Endpoint Central, riconfigurato per il controllo remoto. L'infrastruttura mostra sovrapposizioni con Gh0st RAT e ValleyRAT. -
VBScript via WhatsApp: documenti aziendali falsi installano ManageEngine RMM in campagna globale con tracce cinesi
Kaspersky documenta una campagna malware attiva in 11 Paesi che usa WhatsApp per distribuire VBScript offuscati camuffati da documenti aziendali. Il payload finale è ManageEngine Endpoint Central, riconfigurato per il controllo remoto. L'infrastruttura mostra sovrapposizioni con Gh0st RAT e ValleyRAT. -
Yet another shady #RMM; this time @Automox at:
https:// ecdp.ronaldegesa\.com/Automox_Installer-2.5.70.msi
threat actor access key is c9af8abb-3be8-432d-b651-6da4df3e35a6
-
An unknown threat actor is abusing a remote management tool called #TiFLUX as an initial access vector, targeting a broad range of potential victims by email. The attacks using this Brasil-originated commercial utility began in February, but really ramped up in April and the beginning of this month.
The lures employ a variety of #spam tropes, including bogus event invitations and business invoices/bills.
TiFLUX seems uniquely vulnerable to this kind of abuse; The installer package also installs an old version of UltraVNC as well as a vulnerable #loldriver that can elevate privileges. Weirdest of all, the attackers are also using this RMM to deploy other heavily-abused RMMs, including #Splashtop and #ScreenConnect to the devices that get hit. Those RMMs are connecting to IP addresses associated with known bulletproof hosts.
This is my first post at the @huntress blog: https://www.huntress.com/blog/tiflux-rmm-install
-
An unknown threat actor is abusing a remote management tool called #TiFLUX as an initial access vector, targeting a broad range of potential victims by email. The attacks using this Brasil-originated commercial utility began in February, but really ramped up in April and the beginning of this month.
The lures employ a variety of #spam tropes, including bogus event invitations and business invoices/bills.
TiFLUX seems uniquely vulnerable to this kind of abuse; The installer package also installs an old version of UltraVNC as well as a vulnerable #loldriver that can elevate privileges. Weirdest of all, the attackers are also using this RMM to deploy other heavily-abused RMMs, including #Splashtop and #ScreenConnect to the devices that get hit. Those RMMs are connecting to IP addresses associated with known bulletproof hosts.
This is my first post at the @huntress blog: https://www.huntress.com/blog/tiflux-rmm-install
-
📰 AI-Driven Attacks Fueling MSP Supply Chain Risk, Guardz Report Finds
🤖 AI-driven attacks are hammering MSPs & SMBs. A new Guardz report finds 9/10 SMBs have compromised users, with attackers abusing RMM tools like ScreenConnect for massive supply chain attacks. #MSP #SMB #CyberSecurity #AI #RMM
-
📰 AI-Driven Attacks Fueling MSP Supply Chain Risk, Guardz Report Finds
🤖 AI-driven attacks are hammering MSPs & SMBs. A new Guardz report finds 9/10 SMBs have compromised users, with attackers abusing RMM tools like ScreenConnect for massive supply chain attacks. #MSP #SMB #CyberSecurity #AI #RMM
-
📰 Phishing Campaign Abuses Legitimate SimpleHelp RMM Tool via Fake DHL 'Shipment Arrived' Emails
⚠️ Phishing Alert: Fake DHL 'shipment arrived' emails are dropping a malicious installer for the SimpleHelp RMM tool, giving attackers a backdoor into victim networks. Be cautious with attachments! 📦 #Phishing #Malware #SimpleHelp #RMM
-
CVE Alert: CVE-2026-22676 - Barracuda Networks - RMM - https://www.redpacketsecurity.com/cve-alert-cve-2026-22676-barracuda-networks-rmm/
#OSINT #ThreatIntel #CyberSecurity #cve-2026-22676 #barracuda-networks #rmm
-
CVE Alert: CVE-2026-22676 - Barracuda Networks - RMM - https://www.redpacketsecurity.com/cve-alert-cve-2026-22676-barracuda-networks-rmm/
#OSINT #ThreatIntel #CyberSecurity #cve-2026-22676 #barracuda-networks #rmm
-
💬 Telegram plays an important role in many underground businesses. Threat actors commonly stand up channels to market and support malicious activities such as malware-as-a-service (MaaS) subscriptions. While investigating ScreenConnect servers, a remote access support tool commonly abused by threat actors, we found an interesting business that we had never seen before. This actor used telegram as a storefront and support channel for an underground Remote Access Toolkit Online (RATO) platform. Technically RATO is a service that bundles cPanel and ScreenConnect technology to help its cyber criminal customers remotely access victim machines and manage scams, phishing, and malware (e.g. Latrodectus).
🐀 🔴 We discovered several servers that matched a ScreenConnect signature but these instances did not serve the typical ScreenConnect web content. Instead, their service is called "RATO PLATFORM" and the portal page shows the slogan "Can't catch the RAT__". We've found several telegram channels that promote services named "RATO", use the rat head logo (see attached image), or the domain rato[.]to. Based on their telegram chat content, it's clear their business model is focused on enabling cybercrime.
@rato_support
@ratofaqs
@rato_backup
@rato_hosting
@Rato2_botConsistent with RATO’s “BulletProof & Anti-Red Hosting” feature, we saw many RATO instances on ASNs with a high concentration of malicious activity (e.g., AS202412). Additionally, RATO infrastructure shows strong ties to Indonesia including Indonesian IP addresses in passive DNS and domains within the same cloudflare account used for serving online gambling to Indonesian-speaking users. Collectively, RATO and its customers operate a large number of domains. Here are some examples:
asakusubinitohas[.]com
bmw320ikaka[.]co
cpusx[.]com
newoneazu[.]com
ratmail[.]pro
rato[.]page
rato[.]to
ratodemo[.]pro
sesrecipt[.]com
silk-gen[.]com
sunostart[.]com
viewyourstatementonline[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #malware #maas #telegram #indonesia #screenconnect #latrodectus #rat #rmm #remotemonitoringmanagement #downloader #spam #rato
-
💬 Telegram plays an important role in many underground businesses. Threat actors commonly stand up channels to market and support malicious activities such as malware-as-a-service (MaaS) subscriptions. While investigating ScreenConnect servers, a remote access support tool commonly abused by threat actors, we found an interesting business that we had never seen before. This actor used telegram as a storefront and support channel for an underground Remote Access Toolkit Online (RATO) platform. Technically RATO is a service that bundles cPanel and ScreenConnect technology to help its cyber criminal customers remotely access victim machines and manage scams, phishing, and malware (e.g. Latrodectus).
🐀 🔴 We discovered several servers that matched a ScreenConnect signature but these instances did not serve the typical ScreenConnect web content. Instead, their service is called "RATO PLATFORM" and the portal page shows the slogan "Can't catch the RAT__". We've found several telegram channels that promote services named "RATO", use the rat head logo (see attached image), or the domain rato[.]to. Based on their telegram chat content, it's clear their business model is focused on enabling cybercrime.
@rato_support
@ratofaqs
@rato_backup
@rato_hosting
@Rato2_botConsistent with RATO’s “BulletProof & Anti-Red Hosting” feature, we saw many RATO instances on ASNs with a high concentration of malicious activity (e.g., AS202412). Additionally, RATO infrastructure shows strong ties to Indonesia including Indonesian IP addresses in passive DNS and domains within the same cloudflare account used for serving online gambling to Indonesian-speaking users. Collectively, RATO and its customers operate a large number of domains. Here are some examples:
asakusubinitohas[.]com
bmw320ikaka[.]co
cpusx[.]com
newoneazu[.]com
ratmail[.]pro
rato[.]page
rato[.]to
ratodemo[.]pro
sesrecipt[.]com
silk-gen[.]com
sunostart[.]com
viewyourstatementonline[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #malware #maas #telegram #indonesia #screenconnect #latrodectus #rat #rmm #remotemonitoringmanagement #downloader #spam #rato
-
💬 Telegram plays an important role in many underground businesses. Threat actors commonly stand up channels to market and support malicious activities such as malware-as-a-service (MaaS) subscriptions. While investigating ScreenConnect servers, a remote access support tool commonly abused by threat actors, we found an interesting business that we had never seen before. This actor used telegram as a storefront and support channel for an underground Remote Access Toolkit Online (RATO) platform. Technically RATO is a service that bundles cPanel and ScreenConnect technology to help its cyber criminal customers remotely access victim machines and manage scams, phishing, and malware (e.g. Latrodectus).
🐀 🔴 We discovered several servers that matched a ScreenConnect signature but these instances did not serve the typical ScreenConnect web content. Instead, their service is called "RATO PLATFORM" and the portal page shows the slogan "Can't catch the RAT__". We've found several telegram channels that promote services named "RATO", use the rat head logo (see attached image), or the domain rato[.]to. Based on their telegram chat content, it's clear their business model is focused on enabling cybercrime.
@rato_support
@ratofaqs
@rato_backup
@rato_hosting
@Rato2_botConsistent with RATO’s “BulletProof & Anti-Red Hosting” feature, we saw many RATO instances on ASNs with a high concentration of malicious activity (e.g., AS202412). Additionally, RATO infrastructure shows strong ties to Indonesia including Indonesian IP addresses in passive DNS and domains within the same cloudflare account used for serving online gambling to Indonesian-speaking users. Collectively, RATO and its customers operate a large number of domains. Here are some examples:
asakusubinitohas[.]com
bmw320ikaka[.]co
cpusx[.]com
newoneazu[.]com
ratmail[.]pro
rato[.]page
rato[.]to
ratodemo[.]pro
sesrecipt[.]com
silk-gen[.]com
sunostart[.]com
viewyourstatementonline[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #malware #maas #telegram #indonesia #screenconnect #latrodectus #rat #rmm #remotemonitoringmanagement #downloader #spam #rato
-
💬 Telegram plays an important role in many underground businesses. Threat actors commonly stand up channels to market and support malicious activities such as malware-as-a-service (MaaS) subscriptions. While investigating ScreenConnect servers, a remote access support tool commonly abused by threat actors, we found an interesting business that we had never seen before. This actor used telegram as a storefront and support channel for an underground Remote Access Toolkit Online (RATO) platform. Technically RATO is a service that bundles cPanel and ScreenConnect technology to help its cyber criminal customers remotely access victim machines and manage scams, phishing, and malware (e.g. Latrodectus).
🐀 🔴 We discovered several servers that matched a ScreenConnect signature but these instances did not serve the typical ScreenConnect web content. Instead, their service is called "RATO PLATFORM" and the portal page shows the slogan "Can't catch the RAT__". We've found several telegram channels that promote services named "RATO", use the rat head logo (see attached image), or the domain rato[.]to. Based on their telegram chat content, it's clear their business model is focused on enabling cybercrime.
@rato_support
@ratofaqs
@rato_backup
@rato_hosting
@Rato2_botConsistent with RATO’s “BulletProof & Anti-Red Hosting” feature, we saw many RATO instances on ASNs with a high concentration of malicious activity (e.g., AS202412). Additionally, RATO infrastructure shows strong ties to Indonesia including Indonesian IP addresses in passive DNS and domains within the same cloudflare account used for serving online gambling to Indonesian-speaking users. Collectively, RATO and its customers operate a large number of domains. Here are some examples:
asakusubinitohas[.]com
bmw320ikaka[.]co
cpusx[.]com
newoneazu[.]com
ratmail[.]pro
rato[.]page
rato[.]to
ratodemo[.]pro
sesrecipt[.]com
silk-gen[.]com
sunostart[.]com
viewyourstatementonline[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #malware #maas #telegram #indonesia #screenconnect #latrodectus #rat #rmm #remotemonitoringmanagement #downloader #spam #rato
-
💬 Telegram plays an important role in many underground businesses. Threat actors commonly stand up channels to market and support malicious activities such as malware-as-a-service (MaaS) subscriptions. While investigating ScreenConnect servers, a remote access support tool commonly abused by threat actors, we found an interesting business that we had never seen before. This actor used telegram as a storefront and support channel for an underground Remote Access Toolkit Online (RATO) platform. Technically RATO is a service that bundles cPanel and ScreenConnect technology to help its cyber criminal customers remotely access victim machines and manage scams, phishing, and malware (e.g. Latrodectus).
🐀 🔴 We discovered several servers that matched a ScreenConnect signature but these instances did not serve the typical ScreenConnect web content. Instead, their service is called "RATO PLATFORM" and the portal page shows the slogan "Can't catch the RAT__". We've found several telegram channels that promote services named "RATO", use the rat head logo (see attached image), or the domain rato[.]to. Based on their telegram chat content, it's clear their business model is focused on enabling cybercrime.
@rato_support
@ratofaqs
@rato_backup
@rato_hosting
@Rato2_botConsistent with RATO’s “BulletProof & Anti-Red Hosting” feature, we saw many RATO instances on ASNs with a high concentration of malicious activity (e.g., AS202412). Additionally, RATO infrastructure shows strong ties to Indonesia including Indonesian IP addresses in passive DNS and domains within the same cloudflare account used for serving online gambling to Indonesian-speaking users. Collectively, RATO and its customers operate a large number of domains. Here are some examples:
asakusubinitohas[.]com
bmw320ikaka[.]co
cpusx[.]com
newoneazu[.]com
ratmail[.]pro
rato[.]page
rato[.]to
ratodemo[.]pro
sesrecipt[.]com
silk-gen[.]com
sunostart[.]com
viewyourstatementonline[.]com#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #phishing #malware #maas #telegram #indonesia #screenconnect #latrodectus #rat #rmm #remotemonitoringmanagement #downloader #spam #rato
-
We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.
If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting
-
We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.
If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting
-
We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.
If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting
-
We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.
If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting
-
We planned one report on Keitaro abuse, but we ran out of pages before we ran out of cases.
So here’s Part 2 of 3, a medley of threats that go well beyond AI‑investment scams.Threat actors abuse Keitaro’s traffic distribution, cloaking, and rule engine to hide malicious landing pages behind geo and device-based filters. They stack bulletproof hosting and reverse proxies to add layers of indirection, making takedown and analysis harder. In this post, we share how we overcame this using multi‑protocol, multi‑vantage telemetry. We leveraged JA4+ web server fingerprints, DNS analytics, and Confiant’s visibility into advertising supply chain data to uncover Keitaro abuse and the delivery of malware downloaders, infostealers, weaponized RMMs, wallet drainer campaigns, scams, and email spam and advertising attack vectors.
If you hunt threats distributed via adtech, these indicators can be useful pivots. https://www.infoblox.com/blog/threat-intelligence/no-reach-no-risk-the-keitaro-abuse-in-modern-cybercrime-distribution/
#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising #infostealer #rmm #remotemonitoringmanagement #downloader #malware #spam #airdrop #cryptocurrency #ja4 #ja4_fingerprinting
-
ConnectWise ScreenConnect patched another critical hijacking flaw — 3rd RMM-class CVE in 18 months.
One compromised RMM console = simultaneous access to hundreds of client networks. The patch matters less than auditing who holds admin access right now.
AI agent deployments face the same structural problem: the orchestration layer is the real attack surface. That's the gap VAULT covers.
#infosec #ScreenConnect #RMM #cybersecurity
the-service.live
-
ConnectWise ScreenConnect patched another critical hijacking flaw — 3rd RMM-class CVE in 18 months.
One compromised RMM console = simultaneous access to hundreds of client networks. The patch matters less than auditing who holds admin access right now.
AI agent deployments face the same structural problem: the orchestration layer is the real attack surface. That's the gap VAULT covers.
#infosec #ScreenConnect #RMM #cybersecurity
the-service.live
-
https://ssa-sharing\.cloud
https://app.any.run/tasks/dd8cfd7b-63ef-49b3-8fcc-3f8efb1bd51a
-
https://ssa-sharing\.cloud
https://app.any.run/tasks/dd8cfd7b-63ef-49b3-8fcc-3f8efb1bd51a
-
Signed malware impersonating workplace apps deploys RMM backdoors - https://www.redpacketsecurity.com/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/
#threatintel
#phishing
#signed-malware
#TrustConnect Software
#RMM-backdoor
#ScreenConnect-backdoor -
Signed malware impersonating workplace apps deploys RMM backdoors - https://www.redpacketsecurity.com/signed-malware-impersonating-workplace-apps-deploys-rmm-backdoors/
#threatintel
#phishing
#signed-malware
#TrustConnect Software
#RMM-backdoor
#ScreenConnect-backdoor -
Malicious #simplehelp #rmm #opendir at:
https://katz.adv\.br/dhl/
-
Malicious #simplehelp #rmm #opendir at:
https://katz.adv\.br/dhl/
-
New by me: I’ve been seeing a spike in unwanted apps (PUPs/adware) sneaking onto client endpoints, so I built a practical workaround when allowlisting tools aren’t in the budget.
This post walks through:
✅ a PowerShell cleanup script (Audit vs Remediate)
✅ a JSON “bad app” list you can update over time
✅ how to automate it in your RMM (with a Kaseya VSA X example)
✅ why I avoid Win32_Product and how the fallback config worksMSPs: this is endpoint hygiene, not magic, but it’s consistent and scalable.
#MSP #PowerShell #RMM #Windows #Cybersecurity #EndpointSecurity #Kaseya
-
New by me: I’ve been seeing a spike in unwanted apps (PUPs/adware) sneaking onto client endpoints, so I built a practical workaround when allowlisting tools aren’t in the budget.
This post walks through:
✅ a PowerShell cleanup script (Audit vs Remediate)
✅ a JSON “bad app” list you can update over time
✅ how to automate it in your RMM (with a Kaseya VSA X example)
✅ why I avoid Win32_Product and how the fallback config worksMSPs: this is endpoint hygiene, not magic, but it’s consistent and scalable.
#MSP #PowerShell #RMM #Windows #Cybersecurity #EndpointSecurity #Kaseya
-
New by me: I’ve been seeing a spike in unwanted apps (PUPs/adware) sneaking onto client endpoints, so I built a practical workaround when allowlisting tools aren’t in the budget.
This post walks through:
✅ a PowerShell cleanup script (Audit vs Remediate)
✅ a JSON “bad app” list you can update over time
✅ how to automate it in your RMM (with a Kaseya VSA X example)
✅ why I avoid Win32_Product and how the fallback config worksMSPs: this is endpoint hygiene, not magic, but it’s consistent and scalable.
#MSP #PowerShell #RMM #Windows #Cybersecurity #EndpointSecurity #Kaseya