cyber.hendryadrian.com
Security News · huntress.com

Attackers Used Compromised Credentials to Access Existing TeamViewer Installations

· Original article ↗

Summary

Huntress observed attackers accessing existing TeamViewer installations with known credentials to attempt ransomware deployment, install XMRig, or exfiltrate data. The incidents did not appear to involve a TeamViewer vulnerability or misconfiguration.

Key points

  • Attackers accessed already-installed TeamViewer instances using known credentials, rather than installing the software themselves.
  • Observed activity included attempted ransomware deployment, XMRig installation, and use of curl.exe to exfiltrate endpoint data.
  • Huntress said the activity did not appear to exploit a TeamViewer vulnerability or misconfiguration; the credentials were likely compromised by other means, though their source was unclear.
  • In the described incidents, attackers acted quickly on accessed endpoints and showed no apparent reconnaissance or lateral movement.
  • Huntress recommends maintaining an inventory of systems and installed or accessible applications, especially after changing MSPs, and reviewing TeamViewer’s connections_incoming.txt log for suspicious logins.

Article Details

Event Type
Huntress reports threat actors abusing already-installed TeamViewer instances and other RMM tools to access compromised endpoints, maintain persistence, and conduct endpoint-limited attacks.
Impact
Observed activity included attempted ransomware deployment, installation of the XMRig cryptocurrency miner, and use of curl.exe to exfiltrate data. The TeamViewer incidents involved known credentials and did not appear to result from a TeamViewer vulnerability or misconfiguration. Huntress reported no observed lateral movement or broader infrastructure reconnaissance in the described incidents.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelIn one incident, the native utility curl.exe was used to exfiltrate data from an endpoint.T1219 · Remote Access ToolsThreat actors used already-installed TeamViewer and other RMM tools for remote access and persistence.T1555 · Credentials from Password StoresThe article says credentials may have been stolen via an infostealer or keystroke logger; this is presented as a possibility, not a confirmed method.

Malware

XMRigHowever, recent incidents where threat actors have attempted to install ransomware, installed the XMRig cryptocurrency miner, or used the native utility curl.exe to exfiltrate data from an endpoint, were distinctly

Vendors

HuntressHuntress lives in the small- to medium-sized business (SMB) space, partnering with managed service providers (MSPs), and as a result, sees a wide spectrum of remote monitoring and management (RMM) tool usage. While a

Products

AnyDeskvia some means (often Microsoft's Remote Desktop Protocol, or “RDP”) and installed an RMM tool such as AnyDesk or RustDesk to maintain persistence.RustDeskmeans (often Microsoft's Remote Desktop Protocol, or “RDP”) and installed an RMM tool such as AnyDesk or RustDesk to maintain persistence.ScreenConnectpersistence within a compromised organization. Huntress analysts continue to report on rogue ScreenConnect installations, very often associated with helpdesk or support scams. Huntress analysts have also seenTeamViewerand all have one thing in common: initial access was obtained via an already-installed instance of TeamViewer. That is to say that the threat actor did not copy or download the TeamViewer installation files to the

Related Articles