🧰 Chrome Remote Desktop

The items that name it 4

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Installed post-compromise by threat actors to retain persistent access; seen in March incident

• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeupas tools2026-04-07

  Used by the NightSpire threat actor for remote access/persistence (foothold) on compromised endpoints, observed on both the first and second endpoints in the March 2026 incident

• How Threat Actors Abuse Remote Management Tools | Huntress
  writeupas affected products2026-03-11

  Listed among applications commonly abused to deploy the ScreenConnect Client.

• A Series of Unfortunate (RMM) Events
  writeupas affected products2025-12-18