Ransomware Gangs Leverage Remote Access Tools to Gain Persistence and Evade Defenses
## Cybersecurity: Ransomware and Remote Access Tools
Cybersecurity: Ransomware and Remote Access Tools
Recent ransomware campaigns have increasingly leveraged legitimate remote access tools to gain persistence within enterprise networks. This approach allows attackers to bypass traditional security controls and remain undetected by blending into regular IT operations.
Since early 2025, ransomware groups have been observed using remote access utilities like AnyDesk and Splashtop to infiltrate networks. These tools, often trusted and signed, provide a stealthy entry point, allowing adversaries to bypass conventional detection mechanisms.
Analysts have identified that attackers frequently use credential stuffing and phishing techniques to gain access to privileged accounts. Once inside, they deploy remote access tools to facilitate lateral movement within the network.
The impact of these campaigns includes encrypted file shares, disabled backups, and altered credentials, which prevent administrators from regaining control. High-profile attacks, such as those by LockBit and Black Basta, have combined these tools with file-shredding commands to erase forensic evidence and maximize ransom demands.
Ransomware operators achieve persistent access through two primary methods: hijacking preinstalled remote access tools or deploying new installations using command-line arguments.
Recent ransomware campaigns have increasingly leveraged legitimate remote access tools to gain persistence within enterprise networks.
In the first method, attackers manipulate existing remote access tools by modifying configuration files or injecting credentials. This tactic avoids creating new files on disk, thus evading antivirus scanning.
When existing tools are not present, attackers install remote access software silently. For example, the following command installs AnyDesk as a service:
Start-Process -FilePath '.\AnyDesk.exe' -ArgumentList 'INSTALL=C','STARTWITHWINDOWS=1','SILENT=1' -NoNewWindow
This installation provides a persistent access point. Attackers escalate privileges using utilities like TrustedInstaller, ensuring that even if one access path is removed, others remain operational.
The use of trusted remote administration software as an attack vector necessitates a shift in defense strategies. Organizations are advised to implement strict application whitelisting, enforce multi-factor authentication, and monitor command-line arguments to detect and prevent these advanced persistence tactics.
Based on reporting by Cyber Security News.