AnyDesk
AnyDesk is a legitimate remote desktop and remote monitoring/management application that is frequently abused by threat actors as a dual-use tool rather than malware developed by the actors themselves. Across the provided reporting, it is repeatedly described as being installed post-compromise to provide direct remote access, persistence, backup access channels, and secondary command-and-control capability. Threat actors have silently installed it as an auto-start service, configured unattended access with hardcoded or attacker-set credentials, renamed the executable to reduce suspicion, and in some cases deleted logs to hinder investigation. It has also been used to facilitate lateral movement, malware deployment, credential theft support activity, and data exfiltration through interactive remote sessions and file transfer features.
Observed infection or deployment vectors in the content include social engineering and phishing that persuade victims to install or approve AnyDesk, abuse of unattended-access passwords, post-exploitation deployment after compromise via other malware or valid accounts, and delivery by downloaders or modular malware. Specific examples in the content include InvisibleFerret, a Python-based infostealer/backdoor used in the North Korea-aligned DeceptiveDevelopment campaign, which can download and configure AnyDesk for persistence and remote access; MuddyWater’s HTTP_VIP downloader in Operation Olalampo, which authenticates to attacker infrastructure and deploys AnyDesk; and multiple ransomware and intrusion cases where actors installed AnyDesk after gaining access through VPN abuse, RDP, exploited public-facing applications, or other footholds.
The content associates AnyDesk abuse with multiple threat actors and intrusion sets, including Akira affiliates, Trigona affiliates, MuddyWater/Seedworm, Peach Sandstorm, North Korea-aligned DeceptiveDevelopment operators, and ransomware or extortion activity involving Black Basta, LockBit, Medusa, Karakurt, RagnarLocker, Sodinokibi/REvil, and Netwalker. It is also referenced as a common payload in telephone-oriented attack delivery campaigns and broader cybercriminal email-delivered RMM abuse.
Targeting described in the content is broad and opportunistic, spanning enterprise environments and sectors including government, manufacturing, technology, education, consulting, pharmaceuticals, telecommunications, satellite, defense, healthcare, construction, and cryptocurrency/DeFi-focused developers. Supported platforms in the reporting include Windows primarily, with campaign context also covering Linux and macOS where upstream malware such as InvisibleFerret and BeaverTail targeted those systems.
High-confidence forensic and network indicators mentioned in the content include typical installation paths such as C:\Program Files (x86)\AnyDesk\ for installed versions and C:\Users\Username\AppData\Roaming\AnyDesk for portable use; artifacts including ad.trace, connection_trace.txt, Service.conf, System.conf, User.conf, Cache, Global_cache, Thumbnails, Chat, and Gcapi.dll; default screenshot and recording folders under C:\Users\Username\Pictures\AnyDesk and C:\Users\Username\Videos\AnyDesk; and logs that may reveal connection times, source IPs, permissions granted, file transfers, screenshots, privacy mode requests, and user-input blocking. One report also identified AnyDesk listeners on TCP port 7070 using self-signed TLS certificates with subject CN=AnyDesk Client, serial 01, RSA-2048 keys, and 50-year validity. Additional specific IOCs in the content include AnyDesk Client ID 1148037084 in a LockBit-related intrusion and infrastructure IPs 38.57.40.237:7070, 38.57.41.81:7070, 38.57.44.11:7070, and 38.57.44.232:7070 associated with AnyDesk management access on suspected C2 infrastructure.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-31161 is a 9.8 CVSS critical severity vulnerability that affects how the CrushFTP file transfer application handles user authentication... CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 are affected by a vulnerability in the S3 authorization header processing that allows authentication bypass.
Hackers exploited Triofox flaw CVE-2025-12480 to bypass auth and install remote access tools via the platform’s antivirus feature.
...Fortinet FortiClient EMS... exploited... The vulnerability in question is CVE-2023-48788... SQL injection...
Groups observed using it
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.
AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.
AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.
AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.
AnyDesk is a popular remote desktop application that allows users to connect to computers and devices remotely... threat actors have been known to utilise AnyDesk's capabilities to control computers, therefore gaining unauthorised access to victims' systems.
In at least one instance, the TA deployed a remote management tool (AnyDesk) to further facilitate access.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
3 techniques
Persistence
Huntress analysts have seen a number of incidents since the beginning of 2025 where the threat actor enabled the Guest account through the use of a command line such as the following: net user Guest /active:yes Once the account has been enabled, the threat actor will then change the password to something of their choosing, and then modify the account even further, such as by adding it to the Local Administrators and Remote Desktop Users groups...
Initial access was varied: Social engineering using phone calls and text messages to impersonate IT personnel, and either directing victims to a credential harvesting site or directing victims to run commercial Remote Monitoring and Management (RMM) tools.
To maintain access, the attacker abused Image File Execution Options and deployed AnyDesk for persistence, cleverly renaming it to svchost.exe... reg add "HKLM\..\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\redacted.exe"
Privilege Escalation
2 techniques
Privilege Escalation
Huntress analysts have seen a number of incidents since the beginning of 2025 where the threat actor enabled the Guest account through the use of a command line such as the following: net user Guest /active:yes Once the account has been enabled, the threat actor will then change the password to something of their choosing, and then modify the account even further, such as by adding it to the Local Administrators and Remote Desktop Users groups...
To maintain access, the attacker abused Image File Execution Options and deployed AnyDesk for persistence, cleverly renaming it to svchost.exe... reg add "HKLM\..\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "C:\Windows\redacted.exe"
Stealth
1 technique
Stealth
Lateral Movement
3 techniques
Lateral Movement
At 00:54:36, less than ten minutes after the network scan, the attacker initiated their first lateral movement using Remote Desktop Protocol (RDP) with the compromised account.
Command and Control
3 techniques
Command and Control
researchers observed operatives using tools including AnyDesk, Astrill VPN, shell services, Tailscale and virtual machines to remotely access devices, maintain operational security and increase overall believability
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate remote access software abused to facilitate attacker access during the intrusion.
AnyDesk is used in the observed Trigona attacks to provide direct remote access on compromised systems.
AnyDesk was deployed for persistence and backup remote access, including SafeBoot persistence, as part of Akira intrusion activity preceding ransomware impact.
A suspected AnyDesk-based remote access payload indicated by the DLL naming pattern in the March 26 campaign, delivered through the actor's DLL registration workflow.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.