Ayush Anand retweeted
An attacker installed ScreenConnect, then hid it from Programs and Features with one registry value.
SystemComponent = 1 on its Uninstall key.
- Service: running
- Programs and Features: no ScreenConnect
Sweep both HKLM Uninstall hives (incl. WOW6432Node) for SystemComponent = 1 and read the DisplayName. Installers hide sub-components this way too. A hidden RMM client is not one of them.
Ayush Anand retweeted
My lab runs MDE and Elastic side by side, so I gave Claude Code a skill for each:
- mde-hunt: KQL on MDE + my ADX archive
- elastic-hunt: ES|QL on Elastic
One question, both stacks searched, one table back.
Most SOCs run one of these. Whichever is yours, want the skill? I can share it on GitHub.
Ayush Anand retweeted
Two ScreenConnect implants on one host, 9 minutes apart. A signed cloud client to get in, then a self-hosted one on port 8041, pushed through the first, with the tray icon and banner turned off.
Ayush Anand (@Securityinbits) detonated it in a lab:
newsletter.securityinbits.co…
Ayush Anand retweeted
AnyDesk is in 32 ransomware groups' toolsets in the Ransomware Tool Matrix, more than any other RMM. It's signed and legit, so the alert reads "probably IT" and gets closed.
Ayush Anand (@Securityinbits) ran it in a lab the way crews do:
newsletter.securityinbits.co…
Ayush Anand retweeted
Three network scanners show up across 45+ ransomware groups.
In my lab the scan had one shape: one process, 254 internal IPs, 5 ports, under 30 seconds.
Full walkthrough in Defender KQL + Elastic ES|QL, including how to tell an admin from an operator:
youtu.be/Iun8zko6EZk
Ayush Anand retweeted
INC Ransom dropped a renamed Vicarius vRx agent at C:\Program Files\7-Zip\HealthUpdater.exe and pointed a scheduled task at it.
vRx is legit patch management that can run PowerShell, Bash and Batch on managed hosts. That's remote access.
h/t Harlan Carvey @HuntressLabs
Ayush Anand retweeted
If you don't have a strategy for handling unsanctioned RMM in your environment you're behind the 8-ball. Here's what I would do to start if you're doing nothing about this yet.
1. Download the full list of RMMs from LOLRMM lolrmm.io/api/rmm_tools.json
2. Remove the 1 or 2 you actually use
3. Upload the rest to your EDR and block them by hash
It's better than nothing to start out. Then, if you want to get more sophisticated, create a scheduled task in your favorite AI agent to monitor for changes. Then download the updates and block them in your EDR.
This is literally free and costs you nothing but a few tokens and some time.
Please do this!!
cloud.google.com/blog/topics…
Ayush Anand retweeted
Been testing GPT-6 Astra against some recent malware we collected through IR engagements.
I used the ChatGPT Chrome extension with Guacamole running a @ThruntingLabs FlareVM environment directly inside the browser.
Samples included a recent SynkLoader, SystemBC and a few fairly nasty obfuscated DLLs.
Using high effort, Astra got through the analysis in roughly 15 minutes and found pretty much everything I was looking for, including obfuscated configuration, encrypted passwords embedded in the binaries and the important execution behaviour.
That part impressed me, but overall, computer use is insane!
Compared with GPT-5.6 Sol, the difference is huge. Astra was much better at understanding what was on screen, interacting with the tooling and moving through the analysis without getting lost.
This changes the automation angle quite a bit. You can now start thinking about automating workflows around the actual tools analysts already use, rather than having to rebuild everything around APIs and custom integrations. Just throw Computer Use at it and let it do the work.
Very interesting direction for DFIR and malware analysis!
Ayush Anand retweeted
INTEL DROP
Remote-management tools are the access layer for a lot of live intrusions. We're tracking 949 malicious IPs running RMM software (AnyDesk, ScreenConnect, MeshCentral) across 220 ASNs, most of it in the US, the Netherlands, Germany, and Russia.
RMM staging malware:
104.239.66.61 screen-connect + malware-hosting
130.12.181.111 screen-connect + malware-hosting
185.187.84.31 screen-connect + malware-hosting
120.26.146.96 komari + malware-hosting + sliver
RMM co-located with C2:
102.165.14.23 screen-connect + anydesk + purerat
104.223.81.15 anydesk + purerat
86.48.16.94 screen-connect + asyncrat
89.42.134.220 screen-connect + asyncrat
Bulletproof hosting + brute-force:
45.144.54.188 anydesk + bph
147.45.41.218 meshcentral + bph
103.226.88.135 anydesk + scanner:brute-force
128.1.211.110 anydesk + scanner:brute-force + proxy:frp
#TotalInsights #ThreatIntel #RMM #C2
team-cymru.com/total-insight…












