🧰 AnyDesk

The items that name it 20

• The Fine Art of Frustrating the Adversary
  articleas tools2026-10-01

  Example of an RMM tool that should be blocked or produce high-confidence alerts if not an organization's approved remote-management product.

• Check Point Research — 28th September Threat Intelligence Report
  articleas tools2026-09-28

  Remote access tool used by INC ransomware actors during intrusion.

• The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint
  writeupas classification.technologies2026-09-24
• The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
  writeupas tools2026-09-21

  Legitimate remote desktop application installed by attackers as remote-access tooling; observed with C2 IP 213.111.185[.]108

• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
  articleas tools2026-09-17

  Remote desktop tool used by The Gentlemen.

• Financially Motivated Threat Actor BREEZE COMET Targets Brazil
  articleas tools2026-09-01

  RMM tool victims were convinced to install through voice calls impersonating IT support

• RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress
  articleas classification.technologies2026-08-21
• Fake Refund Scam Hits Shopify Shop App Users
  writeupas tools2026-08-13

  Remote access software that scammers direct victims to install during the fake refund call to gain control of and view the victim's screen.

• Akira Hits Safe Mode: Ransomware Rebooting Around EDR
  writeupas tools2026-08-12

  Legitimate remote-management tool abused as a remote-access trojan and C2 channel; installed as a service configured to start with Windows, used for hands-on-keyboard control and to deliver the ransomware payload via file transfer and clipboard-pasted commands.

• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas affected products2026-06-08

  Retained as core target in v3.

• The Gentleman Ransomware | Defense Evasion TTPs Uncovered | Huntress
  writeupas tools2026-05-21

  Legitimate remote access software abused by The Gentlemen operators for persistence, per previous public reports

• Inside the RaaS Ecosystem: Operators, Affiliates & Attack Tradecraft | Huntress
  writeupas tools2026-05-20

  Installed post-compromise by threat actors to retain persistent access; seen in March incident

• Komari Red: The Monitoring Tool with a Built-in Reverse Shell
  writeupas tools2026-04-30

  Legitimate remote access tool cited as previously abused by adversaries

• Uptick in Bomgar RMM Exploitation
  writeupas tools2026-04-17

  Remote desktop application deployed by threat actors for persistence/further access

• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeupas tools2026-04-07

  Remote access tool; foothold/persistence signal generated on the second endpoint shortly after the Huntress agent was installed

• How Threat Actors Abuse Remote Management Tools | Huntress
  writeupas affected products2026-03-11

  Listed among applications commonly abused to deploy the ScreenConnect Client.

• Fake Tech Support Delivers Havoc Command & Control
  writeupas classification.technologies2026-03-02
• Threats Plague Educational Organizations
  writeupas affected products2025-11-13
• Removing Traces of RMM Tools
  writeupas classification.technologies2024-05-10
• #StopRansomware: SafePay Ransomware (AA26-293A)
  advisoryas classification.technologies