🚨 FAKE RVTOOLS REPOSITORIES ON GITHUB ARE DEPLOYING A ROGUE ACTION1 RMM BACKDOOR.
Full technical breakdown, IOCs, PowerShell detection and Microsoft Sentinel KQL:
🔗 https://thecybersecguru.com/news/fake-rvtools-action1-rmm-backdoor/
Attackers are impersonating the legitimate VMware auditing utility RVTools using fake GitHub repositories.
But instead of RVTools, victims get a trojanized "Dell Setup" MSI that silently installs the legitimate, digitally signed Action1 RMM agent.
The result?
🔴 Persistent NT AUTHORITY\SYSTEM access
🔴 Remote PowerShell and CMD execution
🔴 Full endpoint inventory and remote desktop control
🔴 Attacker-controlled cloud tenant enrollment
🔴 HTTPS traffic that blends into legitimate Action1 infrastructure
Malicious repos and IoCs:
• github[.]com/rvsphex/RVTools
• github[.]com/rvnexa/RVTools
• Rogue Action1 Org ID: 2ef34aba-cb3c-4e19-8b9b-0494bde90540
If your administrator downloads RVTools from GitHub, investigate immediately.
#CyberSecurity #InfoSec #RVTools #Action1 #RMM #ThreatHunting #EDR #VMware #vCenter #ActiveDirectory #Ma