Loading story…
Threat reporting shows legitimate remote administration and monitoring tools being repeatedly repurposed for intrusion, persistence, and ransomware deployment. Walmart Global Tech highlighted abuse of RemotePC, UltraViewer, MSP360, PDQ Deploy, and Zoho Assist, noting their use for remote control, lateral movement, script execution, phishing-enabled access, and data theft; the report tied UltraViewer to FatalRAT activity and linked Zoho tooling to broader exploitation trends, including CVE-2021-40539 in ManageEngine environments. Separately, KELA documented an initial access broker selling access to 53 organizations through Zoho ManageEngine Desktop Central, with victims spanning multiple countries and sectors, including government entities, and assessed that direct compromise or credential abuse was more likely than a managed service provider breach.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Walmart Global Tech published a threat-intelligence overview describing how actors abuse RemotePC, UltraViewer, MSP360, PDQ Deploy, and Zoho Assist. The report tied these tools to activity including FatalRAT infections, Avos Locker deployment, Luna Moth phishing operations, and prior Zoho ManageEngine exploitation.
The Walmart report cites CVE-2021-34688 and CVE-2021-34687 as recent RemotePC vulnerability reports. These disclosures added to prior concerns about older RemotePC versions exposing users to multiple security risks.
The Walmart report states that threat actors exploited Zoho ManageEngine CVE-2021-40539 against the International Committee of the Red Cross. The intrusion involved unauthenticated code execution, privilege escalation, and exfiltration of registry hives and Active Directory files through web shells.
KELA reported that the actor offered 36 additional accesses for sale in September 2020, bringing the total observed across July and September to 53. The combined asking value for all 53 accesses was assessed at $153,850, with at least 10 already sold.
KELA observed the same actor offering about a dozen unauthorized accesses via Zoho ManageEngine Desktop Central on a Russian-speaking underground forum. The listings were part of a broader campaign to sell access into victim organizations.
KELA noted that Zoho ManageEngine Desktop Central had previously been targeted via CVE-2020-10189, which was reported as exploited to install malware. This established earlier abuse of the product before the later access-sales activity.
Sophos reported that Avos Locker operators modified Safe Mode boot settings so AnyDesk could run, then used PDQ Deploy to push batch scripts that disabled security tools, created an admin account, configured auto-logon, and executed ransomware filelessly. Sophos also investigated a Linux component targeting VMware ESXi by killing virtual machines and encrypting VM files.
In an October 8, 2020 update cited by KELA, Zoho said weak credentials on ManageEngine products were the likely cause of the investigated compromises. Zoho also said it would block future logins using weak credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcemedium.com
Open sourceke-la.com
Open sourcecybersecurity.att.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Initial access brokers advertised and sold access to dozens of organizations through **Zoho ManageEngine Desktop Central**, turning a legitimate remote monitoring and management platform into a high-value entry point for ransomware operations. KELA tracked **53 access listings** between July and September 2020 with a combined asking price of **$153,850**, and said at least **10** had already been sold. Victims spanned multiple countries and sectors, including government organizations, while some of the highest-priced listings were tied to companies in Turkey and Canada. Researchers assessed that the compromises were more likely caused by direct attacks against exposed Desktop Central instances and the use of valid credentials than by a single managed service provider breach. The sales fit a broader underground market in which brokers monetized enterprise footholds for follow-on attacks, including ransomware deployment. KELA later counted **242 network access listings** worth about **$1.21 million** in Q4 2020, with common offerings including **RDP**, **VPN**, **Citrix**, **RCE**, and increasingly **RMM**-based access. The appeal of Desktop Central was its ability to provide remote control and script execution across many endpoints, enabling rapid domain-wide compromise; a separate DFIR case involving **NetWalker** showed how quickly ransomware operators could move from initial access to full encryption. Zoho said weak credentials were the likely cause in the investigated Desktop Central cases and moved to block future logins using weak passwords.
Aug 15, 2026
Active in-the-wild exploitation of **SolarWinds Web Help Desk (WHD)** vulnerabilities is being used to achieve **remote code execution (RCE)** on unpatched servers, followed by rapid deployment of legitimate remote administration tooling for persistence and interactive control. Huntress reported intrusions originating from the WHD service (via `wrapper.exe` spawning `java.exe` in the Tomcat-based application), where attackers executed `cmd.exe` to install a Zoho ManageEngine/Zoho Assist RMM agent for unattended access; at least one observed Zoho Assist registration was tied to a Proton Mail address (`esmahyft@proton[.]me`). The activity is linked to recently disclosed WHD issues, including **CVE-2025-40551** (untrusted deserialization leading to code execution, added to **CISA KEV**) and **CVE-2025-26399**, which multiple vendors have cited as being exploited in the wild. Post-compromise, the actor used the Zoho RMM process (`TOOLSIQ.EXE`) as an operational foothold to run **Active Directory discovery** and domain enumeration (e.g., `net group "domain computers" /do`) consistent with preparation for lateral movement. The intrusions also included deployment of **Velociraptor** for endpoint control and collection, and use of **Cloudflare tunnels** to maintain access and route traffic. Huntress noted broad exposure in its ecosystem (84 endpoints across 78 organizations running WHD), indicating a sizable attack surface for organizations that have not patched or mitigated affected WHD instances.
Jun 29, 2026
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026