ManageEngine Endpoint Central

Reported Context (2)

When opened, the files trigger an infection chain that installs ManageEngine Endpoint Central for remote access, with Kaspersky noting possible links to ValleyRAT and Gh0st RAT infrastructure. WhatsApp Phishing Campaign Uses Fake Business Documents to Install Remote-Access Software
The scripts used financial-themed lures and a multi-stage infection chain that ended with the silent installation of ManageEngine Endpoint Central for remote access. WhatsApp VBScript Campaign Installs ManageEngine Endpoint Central for Remote Access

Malware (2)

MITRE ATT&CK (11)

Vendors (1)

Products (1)

Countries (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.