This article turns telemetry from over 1.8 million endpoints into a practical hardening guide for remote access tools most often abused by attackers, including RDP, ScreenConnect, MeshAgent, and VNC. It recommends a tiered defense strategy of blocking, monitoring, and tightly auditing remote tools to reduce attack surface and detect attacker-deployed access quickly. #RDP #ScreenConnect #MeshAgent #VNC #AmmyyAdmin #UltraVNC #RDPWrap
Keypoints
- Telemetry from more than 1.8 million managed endpoints showed 63% of endpoints had more than one remote access tool installed.
- RDP was the most abused protocol, often enabled by attackers through registry changes, disabled authentication controls, and creation of local admin accounts.
- ScreenConnect was abused through CVE-2024-1709 exploitation and trojanized installers that delivered tools such as AsyncRAT and PureHVNC RAT.
- MeshAgent was the most frequently attacker-deployed tool in the dataset and is difficult to remove because it can persist as a Windows service and auto-restart.
- VNC, especially UltraVNC, had a 95.8% malicious detection rate and was commonly used for hidden sessions, credential theft, and trojanized deployment.
- The article recommends a tiered policy: block tools like MeshAgent and Ammyy Admin, monitor and harden tools like VNC and RDP, and tightly audit mainstream tools such as ScreenConnect and AnyDesk.
- Strong controls include MFA, patching internet-facing RMM servers quickly, application allowlisting, network restrictions, and investigating any unauthorized agent installation.
MITRE Techniques
- [T1021.001 ] Remote Desktop Protocol – Used when attackers enabled or abused RDP for remote access and lateral movement [‘RDP enabled via registry change; RDPWrap’]
- [T1112 ] Modify Registry – Used to enable Remote Desktop, disable Network Level Authentication, and alter Terminal Server settings [‘modifying Windows registry keys to enable Remote Desktop connections, disabling the Network Level Authentication requirement’]
- [T1136.001 ] Create Account: Local Account – Used to create new local administrator accounts before enabling RDP access [‘creating a local admin account’]
- [T1546.008 ] Accessibility Features – Used in a sticky-key-style backdoor access chain [‘changing accessibility feature binaries for sticky-key-style backdoor access’]
- [T1190 ] Exploit Public-Facing Application – Used when attackers exploited ScreenConnect CVE-2024-1709 to create admin accounts [‘provided a trivially exploitable authentication bypass’]
- [T1219 ] Remote Access Software – Used for unauthorized RMM deployment such as ScreenConnect, MeshAgent, and VNC [‘any unauthorized RMM installation’]
- [T1059.001 ] PowerShell – Used to deploy malware after ScreenConnect access [‘deploy malware within minutes, typically AsyncRAT, a custom PowerShell RAT’]
- [T1105 ] Ingress Tool Transfer – Used when MeshAgent or other tools were downloaded or dropped after compromise [‘MeshAgent, Tactical RMM downloaded post-compromise’]
- [T1543.003 ] Windows Service – Used when MeshAgent installed itself as a Windows service to persist [‘install itself as a Windows service, lock its binary files, and auto-restart after termination’]
- [T1021.005 ] VNC – Used for hidden remote desktop access and lateral movement through VNC variants [‘hidden VNC servers; VNC from temp directories’]
- [T1036.005 ] Masquerading – Used when malware disguised itself as a benign file, such as UltraVNC renamed to look like an installer [‘UltraVNC disguised as “OneDrivers.exe”‘]
Indicators of Compromise
- [CVE ] Vulnerability identifiers tied to exploited RMM software – CVE-2024-1709, CVE-2024-12356, and CVE-2024-57727
- [Malware/Tool Names ] Attacker-favored remote tools and payloads – MeshAgent, RDPWrap, AsyncRAT, PureHVNC RAT, and Ammyy Admin
- [File Name ] Trojanized or disguised executables and installers – OneDrivers.exe, cracked ScreenConnect installers, and MeshAgent binaries
- [Software/Product Names ] Remote access and RMM platforms referenced in incidents – ConnectWise ScreenConnect, UltraVNC, MeshCentral, Tactical RMM, and AnyDesk
- [Network Infrastructure ] Remote server or relay destinations used by tools – MeshCentral relay infrastructure, ScreenConnect server URL, and attacker-controlled infrastructure