RemotePC

Reported Context (4)

#PrinzEugen ThreatDown Details Prinz Eugen Ransomware’s Encryption and Anti-Forensic Tactics
SLTTs into clicking a TryCloudflare phishing link that automatically downloaded legitimate RemotePC software, another RMM technology product. Vimeo-Themed Phishing Campaign Steals Personal and Banking Data
RMM tools (Datto, NâAble, RemotePC, Zoho Assist, ScreenConnect) were the most common payloads, abused because they are legitimate enterprise software that can evade detection if allow-listing is not enforced. Proofpoint Reports Over 100 Tax-Themed Campaigns Using RMM Tools and Credential Phishing
In observed cases, victims clicked a TryCloudflare phishing link leading to an automatic download of legitimate RemotePC software, which would grant threat actors complete access to the victims’ computers. IRS-Themed Phishing Campaign Uses TryCloudflare Links to Deliver RemotePC

Malware (3)

Threat Actors (5)

MITRE ATT&CK (14)

Vendors (2)

Products (8)

Tools (1)

Industries (1)

Countries (14)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.