Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareRansomwareUsed by 12 actorsExploits 3 CVEs

AnyDesk

AnyDesk is a legitimate remote desktop and remote monitoring/management application that is frequently abused by threat actors as a dual-use tool rather than malware developed by the actors themselves. Across the provided reporting, it is repeatedly described as being installed post-compromise to provide direct remote access, persistence, backup access channels, and secondary command-and-control capability. Threat actors have silently installed it as an auto-start service, configured unattended access with hardcoded or attacker-set credentials, renamed the executable to reduce suspicion, and in some cases deleted logs to hinder investigation. It has also been used to facilitate lateral movement, malware deployment, credential theft support activity, and data exfiltration through interactive remote sessions and file transfer features.

Observed infection or deployment vectors in the content include social engineering and phishing that persuade victims to install or approve AnyDesk, abuse of unattended-access passwords, post-exploitation deployment after compromise via other malware or valid accounts, and delivery by downloaders or modular malware. Specific examples in the content include InvisibleFerret, a Python-based infostealer/backdoor used in the North Korea-aligned DeceptiveDevelopment campaign, which can download and configure AnyDesk for persistence and remote access; MuddyWater’s HTTP_VIP downloader in Operation Olalampo, which authenticates to attacker infrastructure and deploys AnyDesk; and multiple ransomware and intrusion cases where actors installed AnyDesk after gaining access through VPN abuse, RDP, exploited public-facing applications, or other footholds.

The content associates AnyDesk abuse with multiple threat actors and intrusion sets, including Akira affiliates, Trigona affiliates, MuddyWater/Seedworm, Peach Sandstorm, North Korea-aligned DeceptiveDevelopment operators, and ransomware or extortion activity involving Black Basta, LockBit, Medusa, Karakurt, RagnarLocker, Sodinokibi/REvil, and Netwalker. It is also referenced as a common payload in telephone-oriented attack delivery campaigns and broader cybercriminal email-delivered RMM abuse.

Targeting described in the content is broad and opportunistic, spanning enterprise environments and sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, telecommunications, satellite, defense, healthcare, construction, and cryptocurrency/DeFi-focused developers. Supported platforms in the reporting include Windows primarily, with campaign context also covering Linux and macOS where upstream malware such as InvisibleFerret and BeaverTail targeted those systems.

High-confidence forensic and network indicators mentioned in the content include typical installation paths such as C:\Program Files (x86)\AnyDesk\ for installed versions and C:\Users\Username\AppData\Roaming\AnyDesk for portable use; artifacts including ad.trace, connection_trace.txt, Service.conf, System.conf, User.conf, Cache, Global_cache, Thumbnails, Chat, and Gcapi.dll; default screenshot and recording folders under C:\Users\Username\Pictures\AnyDesk and C:\Users\Username\Videos\AnyDesk; and logs that may reveal connection times, source IPs, permissions granted, file transfers, screenshots, privacy mode requests, and user-input blocking. One report also identified AnyDesk listeners on TCP port 7070 using self-signed TLS certificates with subject CN=AnyDesk Client, serial 01, RSA-2048 keys, and 50-year validity. Additional specific IOCs in the content include AnyDesk Client ID 1148037084 in a LockBit-related intrusion and infrastructure IPs 38.57.40.237:7070, 38.57.41.81:7070, 38.57.44.11:7070, and 38.57.44.232:7070 associated with AnyDesk management access on suspected C2 infrastructure.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES
CVE-2025-31161Authentication Bypass in CrushFTP S3 Authorization HandlingExploited in the wild

CVE-2025-31161 is a 9.8 CVSS critical severity vulnerability that affects how the CrushFTP file transfer application handles user authentication... CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass.

via huntress bloghuntress.com
CVE-2025-12480Authentication Bypass and RCE in Gladinet TriofoxExploited in the wild

Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.

via securityaffairssecurityaffairs.com
CVE-2023-48788SQL Injection Leading to RCE in Fortinet FortiClient EMSExploited in the wild

...Fortinet FortiClient EMS... exploited... The vulnerability in question is CVE-2023-48788... SQL injection...

via cloudatg insightscloudatg.com
THREAT ACTORS

Groups observed using it

12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Karakurt

AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.

via ncc group researchnccgroup.com
Black Basta

AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.

via ncc group researchnccgroup.com
Medusa Group

AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.

via ncc group researchnccgroup.com
RagnarLocker

AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.

via ncc group researchnccgroup.com
LockBit

AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.

via ncc group researchnccgroup.com
MuddyWater

In at least one instance, the TA deployed a remote management tool (AnyDesk) to further facilitate access.

via rapid7 blograpid7.com
MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique
T1588.002ToolEvidence1

It is a common technique to leverage third-party legitimate software for malicious purposes (T1588.002), which makes detecting and attributing APT activity more difficult.

Initial Access

1 technique
T1133External Remote ServicesEvidence4

Initial access was varied: Social engineering using phone calls and text messages to impersonate IT personnel, and either directing victims to a credential harvesting site or directing victims to run commercial Remote Monitoring and Management (RMM) tools.

Execution

1 technique
T1204User ExecutionEvidence1

The user must authorize the connection before it can be fully established... the victim... clicked Accept.

Persistence

3 techniques
T1098Account ManipulationEvidence1

Huntress analysts have seen a number of incidents since the beginning of 2025 where the threat actor enabled the Guest account through the use of a command line such as the following: net user Guest /active:yes Once the account has been enabled, the threat actor will then change the password to something of their choosing, and then modify the account even further, such as by adding it to the Local Administrators and Remote Desktop Users groups...

T1133External Remote ServicesEvidence4

Initial access was varied: Social engineering using phone calls and text messages to impersonate IT personnel, and either directing victims to a credential harvesting site or directing victims to run commercial Remote Monitoring and Management (RMM) tools.

T1546.012Image File Execution Options InjectionEvidence1

To maintain access, the attacker abused Image File Execution Options and deployed AnyDesk for persistence, cleverly renaming it to svchost.exe... reg add "HKLM\..\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\redacted.exe"

Privilege Escalation

2 techniques
T1098Account ManipulationEvidence1

Huntress analysts have seen a number of incidents since the beginning of 2025 where the threat actor enabled the Guest account through the use of a command line such as the following: net user Guest /active:yes Once the account has been enabled, the threat actor will then change the password to something of their choosing, and then modify the account even further, such as by adding it to the Local Administrators and Remote Desktop Users groups...

T1546.012Image File Execution Options InjectionEvidence1

To maintain access, the attacker abused Image File Execution Options and deployed AnyDesk for persistence, cleverly renaming it to svchost.exe... reg add "HKLM\..\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\redacted.exe"

Stealth

1 technique
T1036MasqueradingEvidence1

deployed AnyDesk for persistence, cleverly renaming it to svchost.exe.

Lateral Movement

3 techniques
T1021Remote ServicesEvidence6

At 00:54:36, less than ten minutes after the network scan, the attacker initiated their first lateral movement using Remote Desktop Protocol (RDP) with the compromised account.

T1021.001Remote Desktop ProtocolEvidence2

At 00:54:36, less than ten minutes after the network scan, the attacker initiated their first lateral movement using Remote Desktop Protocol (RDP) with the compromised account.

T1021.002SMB/Windows Admin SharesEvidence1

In addition to lateral movement through AnyDesk, the operators created additional Cobalt Strike beacons within the Admin$ share folders on compromised domain controllers (T1021.002 Remote Services: SMB/Windows Admin Shares).

Command and Control

3 techniques
T1090ProxyEvidence1

researchers observed operatives using tools including AnyDesk, Astrill VPN, shell services, Tailscale and virtual machines to remotely access devices, maintain operational security and increase overall believability

T1105Ingress Tool TransferEvidence5

File IOCs ... AnyDesk.exe ... SimpleService.exe ... elev_win.exe ... KslD.sys ... winupdate.exe (Restic)

T1219Remote Access ToolsEvidence24

Indicators of Compromise (IOC) List Domains/URLs http://139.180.134.221/sdksdk608/anydesk%5f0117.zip

Exfiltration

2 techniques
T1041Exfiltration Over C2 ChannelEvidence1

Using the Anydesk FileTransfer facility, the attacker stole and exfiltrated these company files.

T1048Exfiltration Over Alternative ProtocolEvidence1

...credentials and other stolen data collected in a file named qwertyuio.txt is exfiltrated through AnyDesk file manager to avoid detection.

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.md5●●●●●●●●●●●●View more in app1 month ago
hash.sha256●●●●●●●●●●●●View more in app2 months ago
ip.v4●●●●●●●●●●●●View more in app4 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution12

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.