Mesh Agent

Reported Context (4)

The executable was a golang binary used as a loader for a Mesh Agent executable, a common remote access tool, within the same directory titled web.exe. Huntress Details Intrusion Targeting Executive at Market Research Company
between the two; specifically, IOCs such as the 2.58.56[.]16 IP address, installation of the Mesh Agent RMM, and the d3d11.dll file. Huntress Finds Attackers Reused Tactics in CrushFTP and CentreStack Intrusions
Huntress analysts have observed incidents where threat actors have used various means to install RMM tools such as SimpleHelp or Mesh Agent. Huntress Details Attacks Using Multiple RMM Tools, Including Akira Ransomware Deployment
🛠 Established persistence using a renamed Mesh Agent Huntress Shares Incident Examples and Tips for Detecting Persistent Malware

CVE (2)

Malware (4)

People (1)

MITRE ATT&CK (25)

Vendors (4)

Products (16)

Tools (9)

Industries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.