Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control

Cybersecurity: Ransomware Operations and Remote Access Tools

Modern ransomware operations have developed into sophisticated, multi-stage campaigns utilizing legitimate Remote Access Tools (RATs) to remain stealthy and persistent while dismantling organizational defenses.

Ransomware encrypts critical organizational data and demands ransom payments for restoration. Unlike early campaigns that relied on mass phishing, modern operations involve targeted attacks.

These adversaries exploit trusted administrative software such as AnyDesk, UltraViewer, RustDesk, and Splashtop to establish backdoors, escalate privileges, and deploy payloads across enterprise networks. Attackers infect machines, move laterally, harvest credentials, neutralize defenses, and maintain control while evading detection.

The Remote Access Tools mentioned are legitimate software designed for IT administration and remote support. The misuse discussed arises from misconfiguration or inadequate monitoring rather than inherent vulnerabilities.

Legitimate Remote Access Tools exploited include AnyDesk, UltraViewer, AppAnywhere, RustDesk, CloneDesk, Splashtop, and TightVNC. Many offer free versions, making them attractive to attackers due to their ease of deployment, trustworthiness, and frequent whitelisting in enterprise environments. These tools provide:

Unattended access: Connect without user interaction. File transfer: Move binaries or exfiltrate data. Interactive desktop control: Execute administrative tasks remotely. Encrypted communications: Evade network monitoring.

Organizations often whitelist these tools, allowing attackers to bypass security controls. Understanding their misuse is critical for building effective defenses against ransomware threats.

The ransomware kill chain outlines each stage of an attack, from initial access to final impact. When attackers leverage legitimate Remote Access Tools, they gain stealth, persistence, and control, complicating detection and mitigation.

Understanding each stage helps defenders recognize attack patterns and build stronger, layered defenses. This knowledge enables security teams to anticipate adversary behavior and take timely action to disrupt malicious activity.

Stage 1: Initial Access – Credential Compromise

Attackers gain legitimate access using stolen or brute-force credentials, bypassing defenses while appearing as trusted users. Targeting administrator accounts provides maximum control and enables later stages.

Brute-force attacks against RDP/SMB endpoints. Credential reuse from leaks or past breaches. Targeting administrator accounts for maximum privileges.

Windows Event IDs 4625 → 4624 (multiple failed logins followed by success). RDP logon type 10 at unusual hours. Logins from unexpected geolocations.

Stage 2: Remote Tool Abuse – Hijacking vs. Silent Installation

Post-access, attackers deploy Remote Access Tools for persistence. They may hijack existing tools to avoid detection or perform silent installations using signed installers with minimal footprint.

Method 1: Hijacking Existing Remote Access Tools

Enumerate installed tools via WMI, registry, or PowerShell. Add attacker credentials or modify access configurations. Avoids new file creation, reducing detection risk.

Method 2: Silent Installation of Remote Access Tools

Deploy lightweight installers using silent install flags like /S , /VERYSILENT , /quiet , /NORESTART .

Remote Tools Commands Purpose / Effect

AnyDesk anydesk.exe --install "C:\ProgramData\AnyDesk" --silent --start-with-win Persistent remote access service

UltraViewer UltraViewer_Setup.exe /VERYSILENT /NORESTART Install quietly with no reboot

AppAnywhere msiexec /i AppAnywhere.msi /quiet /norestart Enterprise-style silent deployment

RustDesk rustdesk.exe --service install --password "Str0ngPass123" Enables unattended remote access

CloneDesk CloneDesk_Setup.exe /S /D=C:\ProgramData\CloneDesk Minimal footprint installation

Splashtop Splashtop_Streamer.exe /s /i silent=1 precheck=0 confirm=0 Quiet, enterprise deployment

TightVNC tightvnc-setup.exe /S /NORESTART CLI-driven hidden installation

Stage 3: Persistence & Privilege Consolidation

Attackers use registry run keys, hidden scheduled tasks, and configuration file modifications for persistence. Privilege escalation is achieved using tools like PowerRun or TrustedInstaller.

Registry Run Keys: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Scheduled Tasks: Hidden tasks to auto-restart tools. Configuration Files: Modify config.toml (RustDesk) for unattended access. Privilege Escalation: Launch tools as SYSTEM using PowerRun or TrustedInstaller.

Stage 4: Antivirus Neutralization & Anti-Forensics

Attackers use Remote Access Tools to stop Antivirus services, manipulate group policies, and clear logs. File shredding tools remove forensic evidence, complicating post-incident investigation.

Stop Antivirus services: sc stop <service> or net stop <service> Policy manipulation: Add tool directories to exclusions. Log clearing: Commands like wevtutil cl Security , wevtutil cl System , wevtutil cl Application . File shredding: Remove forensic artifacts.

Stage 5: Payload Deployment & Execution

Attackers disable security measures, clear logs, and shred files to evade detection. Ransomware is delivered through Remote Access Tool channels, executed within existing sessions.

Below are Remote Access Tools commonly abused in ransomware campaigns for persistence and deployment:

Remote Access Tool Associated Ransomware Campaigns

AnyDesk TargetCompany, D3adCrypt, Makop, Mallox, Phobos, LockBit 2.0, LockBit 3.0, LockBit 2025 Renegade, Beast, Dharma, Proton/Shinra, MedusaLocker

UltraViewer Beast, CERBER, Dharma (.cezar Family), GlobeImposter 2.0, LockBit 3.0, Makop, Phobos, SpiderPrey, TargetCompany

AppAnywhere Makop, Ryuk, D3adCrypt, Dharma

RustDesk Mimic, LockXXX, Dyamond, D3adCrypt, Makop

Splashtop Makop, BlueSky, RansomHub, Proxima

TightVNC Cerber 4.0/5.0

Understanding the tactics, techniques, and procedures (TTPs) used by adversaries is crucial for defense. Mapping these activities to the MITRE ATT&CK framework helps visualize how attackers gain access and deploy tools.

Stages Technique MITRE ATT&CK Sub-Technique ID Observations

Initial Access Brute Force T1110.001 Targeting RDP/SMB endpoints to gain access

Tool Deployment Ingress Tool Transfer T1105 Remote access utilities transferred for execution

Execution Remote Services T1021.001 Remote sessions used to execute payloads

Persistence Registry Run Keys T1547.001 Registry keys created/modified for tool persistence

Privilege Escalation Abuse Elevation Control Mechanism T1548.002 Elevation of privileges observed to run tools with SYSTEM rights

Defense Evasion Impair Defenses T1562.001 Security services disabled, logs cleared

Lateral Movement Remote Services T1021.001 Remote services abused to move across endpoints

Impact Data Encrypted for Impact T1486 Tools leveraged to deploy ransomware and encrypt data

Ransomware operators are developing new tactics that extend beyond traditional exploitation. These trends include:

AI-driven Remote Access Tool deployment: Automated decision-making for payloads. Cloud Remote Access Tool abuse: Exploiting cloud-based remote access portals. RaaS integration: Remote Access Tools embedded in ransomware-as-a-service offerings. Multi-stage attacks: Initial tool compromise followed by secondary payloads.

Ransomware actors may attempt to weaponize trusted tools. A comprehensive security strategy incorporates multiple defense layers to prevent such activities. Modern security platforms provide:

Virus Protection: Detects and neutralizes hidden payloads. Antivirus Self Protection: Prevents termination or uninstallation of security services. Behavior-Based Detection: Monitors for abnormal activities linked to ransomware. Ransomware Protection: Blocks unauthorized encryption attempts in real time. Application Control: Restricts unauthorized remote tools.

Enterprises need a layered approach combining governance, monitoring, and rapid response. Modern security solutions provide Antivirus protection, behavioral detection, and Anti-Ransomware protection, ensuring organizations can protect their assets against sophisticated ransomware campaigns.

Based on reporting by GBHackers.