Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation
Tiflux RMM Triple-Threat Campaign (TL-2026-0520), also tracked as Tiflux Triple Threat, is a high-severity malware campaign, first published 2026-05-17. It has no confirmed attribution, affects Tiflux Sistema de Gestao LTDA Tiflux RMM (TiAgent / TiService /, maps to 30 MITRE ATT&CK techniques (T1003, T1007, T1036), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0520
- Threat ID
- TL-2026-0520
- Also known as
- Tiflux Triple Threat, Rogue Tiflux RMM Campaign, Service Agreement Email RMM Campaign, LOLRMM Tiflux
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-17
- Last reviewed
- 2026-05-17
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- managed-service-providers, small-business, professional-services, legal, financial-services
- Target regions
- North America, Latin America, Europe
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Tiflux RMM Triple-Threat Campaign
Malware and tooling: ConnectWise ScreenConnect (operator-controlled), HwRwDrv (Hardware Read/Write Driver), Splashtop Streamer, UltraVNC
An active malspam campaign tracked by the Huntress SOC since February 27, 2026 weaponizes Tiflux, a Brazilian commercial RMM, as the initial foothold for stealthy remote access against organizations primarily reached through fake service-agreement and document lures. The signed Tiflux .msi installer chains additional remote-control tools (UltraVNC, Splashtop, ScreenConnect), abuses a Bring-Your-Own-Vulnerable-Driver (BYOVD) component HwRwDrv.sys for privilege elevation, and contains hardcoded VNC credentials, Secure-Attention-Sequence-disabling registry payloads, and a hardcoded PuTTY SSH key for the operator's infrastructure (remote1a.peopleone.com.br). Observed outcomes include unauthorized access, system profiling via osquery, screenshot exfiltration, and credential theft.
How Tiflux RMM Triple-Threat Campaign works
Beginning February 27, 2026 and escalating through May 2026, Huntress observed a recurring intrusion pattern across multiple managed customers in which threat actors abuse Tiflux — a lesser-known commercial RMM produced by Tiflux Sistema de Gestao LTDA (Brazil) — as the primary remote-control surface delivered via malspam. The campaign is notable not only for adopting another LOLRMM tool but for stacking three additional remote-control suites and a kernel-mode privilege-escalation driver inside a single signed .msi package, blurring the line between rogue install and legitimate Brazilian MSP tooling.
Initial Access (TA0001): Targets receive a phishing email purporting to share a service agreement or business document. A representative lure observed on May 1, 2026 was sent from businessservices@hg.lawdepotisland.com and linked to a Cloudflare-CAPTCHA-gated landing page at lenwillfilenetwork.com that redirected through a fake document-download page to deliver Network Solutions Agreement.msi. A second variant observed the following day used a fake CAPTCHA dialog that incongruously rendered macOS visual chrome inside Microsoft Edge on Windows before serving the same installer. Alternative payload URLs included https://anythinghere.woremix.icu/Viewfiles/download.php. The malicious installer is signed by Tiflux Sistema de Gestao LTDA, and Huntress observed signing timestamps just one day prior to analysis, suggesting either a recently-issued cert, abuse of an MSP build pipeline, or operator-controlled signing infrastructure.
Execution & Installation (TA0002): The .msi spawns msiexec.exe and lays down the standard Tiflux components (TiAgent, TiService, TiPeerToPeer, si.exe) plus three bundled 'dependencies' — UltraVNC, 7zip, and tar. Once TiService is registered and running, the Tiflux orchestrator uses its built-in software-push feature to download and install ScreenConnect and/or Splashtop with no user notification. Huntress observed both Tiflux and Splashtop services subsequently checking in to their respective control servers and Splashtop launching osqueryi.exe to enumerate host telemetry and OS-level state.
Persistence (TA0003): Tiflux installs itself as a Windows service (TiService) along with the third-party RMMs (Splashtop service, ScreenConnect service). Five .reg files bundled with the installer extend persistence: one adds a Services entry for TightVNC (under the nonstandard path C:\PeopleOne\dependencies ightvnc vnserver.exe) with the SafeBoot flag set so the VNC service survives Safe Mode reboots. Another .reg adds a PuTTY SSH host key pinned to remote1a.peopleone.com.br, enabling passwordless SSH to operator infrastructure even though PuTTY itself is not installed by the campaign. UltraVNC drops the legacy 'mv video hook driver2' display adapter (originally published April 11, 2007) which persists in Device Manager.
Privilege Escalation (TA0004): The campaign drops the vulnerable driver HwRwDrv.x64 (HwRwDrv.sys) into the user's %TEMP% directory and registers it as a kernel driver. HwRwDrv exposes arbitrary physical-memory read/write primitives via IOCTL — it is a well-known BYOVD candidate present on LOLDrivers and on Microsoft's Vulnerable Driver Blocklist, enabling token-swap and kernel-memory-patch attacks to elevate from medium to SYSTEM/kernel. The driver's Authenticode signing certificate has been revoked for years; Windows displays a 'certificate revoked' status on the file's properties sheet, yet the driver still loads because Windows does not enforce revocation for already-trusted signers on most installations.
Defense Evasion (TA0005): Two of the bundled .reg files disable the Secure Attention Sequence (SAS) and suppress consent / notification prompts that would otherwise reveal interactive VNC sessions, allowing a remote operator to use the desktop without producing the visual cues a victim or local helpdesk would expect. The use of signed RMM installers (Tiflux, Splashtop, ScreenConnect, UltraVNC) lets the kill chain ride on legitimate digital signatures and bypass naive trust-based controls. Renaming the malicious .msi to Adobeclient-33.2.msi or 'Network Solutions Agreement.msi' frames the file as routine and helps avoid suspicion at the user.
Credential Access (TA0006): UltraVNC initialization .ini files inside the package contain two hardcoded VNC passwords stored as DES-encoded hex blobs which are trivially reversible using public tools, providing the operator a fallback authentication path even if the deployed install is altered. The TiPeerToPeer messaging component embeds a hardcoded secret key and beacons on 21116/udp to operator infrastructure. Observed incidents resulted in credential theft from compromised hosts.
Discovery & Collection (TA0007, TA0009): Splashtop on infected hosts executed osqueryi.exe to enumerate processes, services, network configuration, installed software, and accounts. Both Tiflux and Splashtop captured screenshots and screenshot thumbnails, transmitting them back to operator-controlled management consoles. The 32-bit UltraVNC .ini left a build-machine path string identifying a developer linked via OSINT to both Tiflux and 'PeopleOne', a Brazilian MSP brand.
Command and Control (TA0011): Three concurrent RMM control planes operate in parallel — Tiflux (Brazilian-hosted RMM cloud and TiPeerToPeer UDP/21116 to its backend), Splashtop (vendor cloud), and ScreenConnect (operator-controlled C2 at 84.54.33.192:8040 hosting ScreenConnect.ClientSetup.msi at /Bin/ScreenConnect.ClientSetup.msi). Operator-controlled domains include shankar.woremix.icu and anythinghere.woremix.icu (parent woremix.icu), plus the SSH-pinned remote1a.peopleone.com.br, which was offline at the time of Huntress publication on May 7, 2026.
Impact (TA0040): Huntress observed unauthorized interactive access, system enumeration, screenshot harvesting, and credential theft. The presence of HwRwDrv elevates the potential blast radius to kernel-mode tampering, AV/EDR neutralization, and lateral movement using stolen credentials. The chained, signed nature of the toolset makes the campaign disproportionately resistant to signature-based detection and underscores the need for application control (e.g., explicit allowlisting of authorized RMMs only) and Microsoft's Vulnerable Driver Blocklist enforcement.
MITRE ATT&CK techniques used in TL-2026-0520
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials
Discovery
T1007 System Service Discovery; T1057 Process Discovery; T1082 System Information Discovery
Defense Evasion
T1036 Masquerading; T1218 System Binary Proxy Execution; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Command and Control
T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Persistence
T1098 Account Manipulation; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
defense-impairment
T1112 Modify Registry; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Collection
Execution
T1204 User Execution; T1569 System Services
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
Affected products and versions in Tiflux RMM Triple-Threat Campaign
- Tiflux Sistema de Gestao LTDA — Tiflux RMM (TiAgent / TiService / TiPeerToPeer)
Vulnerable versions: all current installer builds redistributed by threat actors - UltraVNC (uvnc bvba) — UltraVNC bundled by Tiflux campaign
Vulnerable versions: 1.2.0.1 (legacy, certificate expired March 2014)
Fixed in: 1.6.4.0 (current legitimate release) - Splashtop — Splashtop Streamer / Splashtop RMM pushed via Tiflux
Vulnerable versions: versions installed silently by Tiflux push capability - ConnectWise — ScreenConnect / ConnectWise Control client pushed via Tiflux
Vulnerable versions: client builds delivered from 84.54.33.192:8040 - HwRwDrv (Hardware Read/Write Driver) — HwRwDrv.sys / HwRwDrv.x64 vulnerable kernel driver
Vulnerable versions: all signed builds with revoked certificate
Fixed in: blocked by Microsoft Vulnerable Driver Blocklist - Microsoft — Windows 10 / Windows 11 / Windows Server (BYOVD-exposed hosts)
Vulnerable versions: any without HVCI / Microsoft Vulnerable Driver Blocklist enforcement
Fixed in: hosts with HVCI + Microsoft Vulnerable Driver Blocklist enabled
Remediation for Tiflux RMM Triple-Threat Campaign
Patches
- There is no CVE / vendor patch — this is RMM-abuse tradecraft. Tiflux, Splashtop, ScreenConnect, and UltraVNC are legitimate products being weaponized via social engineering and BYOVD. Apply Microsoft Vulnerable Driver Blocklist updates (KB5036899 and later cumulative driver-blocklist updates) to block HwRwDrv kernel-driver loads
Immediate actions
- Block the IOC IP 84.54.33.192 and domains lenwillfilenetwork.com, woremix.icu (and subdomains shankar.woremix.icu, anythinghere.woremix.icu), hg.lawdepotisland.com, and remote1a.peopleone.com.br at the perimeter and DNS layer
- Block UDP/21116 outbound to non-sanctioned destinations to interdict TiPeerToPeer beaconing
- Quarantine and reimage any host running TiAgent, TiService, or TiPeerToPeer that is not part of a sanctioned MSP relationship with Tiflux
- Hunt for HwRwDrv.sys / HwRwDrv.x64 in %TEMP% and in registry hive HKLM\SYSTEM\CurrentControlSet\Services; remove and reboot the host
- Audit Windows Services for entries pointing to C:\PeopleOne\dependencies\tightvnc\tvnserver.exe and for the 'mv video hook driver2' display adapter; remove on unsanctioned hosts
- Force credential rotation for any account that logged into a compromised host; assume credentials are exfiltrated
Workarounds
- Disable Windows installer execution from non-admin profiles via Group Policy (DisableMSI = 2) where business processes allow
- Require interactive UAC consent for msiexec.exe even when run from elevated processes
- If Tiflux is not an authorized MSP tool in the environment, block the publisher certificate 'Tiflux Sistema de Gestao LTDA' via WDAC publisher rule
Longer-term hardening
- Enable Microsoft Vulnerable Driver Blocklist (HVCI / Smart App Control) to deny HwRwDrv and other BYOVD candidates from loading
- Implement application control (WDAC, AppLocker, or third-party allow-listing) restricting installation of RMM software to a named allowlist; explicitly block Tiflux, UltraVNC, TightVNC, Splashtop, and ScreenConnect unless required
- Subscribe to LOLRMM and LOLDrivers feeds and operationalize them as blocklists in EDR and application-control policies
- Deploy detections that alert on msiexec.exe launching from user-writable paths (Downloads, %TEMP%) with signed-but-unexpected publishers including 'Tiflux Sistema de Gestao LTDA'
- Deploy email-gateway rules to flag inbound mail containing CAPTCHA-gated download links and .msi attachments / links from newly-registered domains
- Enable PowerShell and Sysmon DriverLoad (event ID 6) logging and forward to SIEM with high-fidelity rules on revoked / expired-certificate driver loads
Weaknesses (CWE) in Tiflux RMM Triple-Threat Campaign
CWE-829, CWE-1233, CWE-732, CWE-295
Timeline of Tiflux RMM Triple-Threat Campaign
- Huntress SOC observes initial uptick in incidents involving Tiflux RMM being abused across multiple managed customers
- Malspam email from businessservices@hg.lawdepotisland.com delivers Cloudflare-CAPTCHA-gated link to lenwillfilenetwork.com hosting Network Solutions Agreement.msi
- Variant attack chain spotted using a fake CAPTCHA dialog that renders macOS visual chrome inside Microsoft Edge on Windows; delivers same Tiflux .msi installer
- Network Solutions Agreement.msi observed cryptographically signed by 'Tiflux Sistema de Gestao LTDA' approximately one day before Huntress analysis
- TiPeerToPeer client documented beaconing on UDP/21116 for at least a 14-hour period following initial installation in Huntress test environment
- Huntress publishes blog 'Threat Actors Weaponize Tiflux RMMs in Malspam Attacks' detailing the campaign, IOCs, and toolchain; remote1a.peopleone.com.br confirmed offline at time of publication
- Threadlinqs Intelligence publishes TL-2026-0520 with full MITRE mapping, IOCs, detections, and simulations
- As of 2026-05-29, this Brazilian-origin Tiflux RMM malspam campaign remains an active financially-motivated threat: Huntress (May 7) and follow-on reporting (TechRadar, CraftedSignal) note growing abuse since Feb 27 with fresh lures observed May 1-2. The operator's SSH endpoint went offline, but no actor takedown/arrest occurred and the LOLRMM + BYOVD HwRwDrv.sys tradecraft stays viable.
Sources cited for Tiflux RMM Triple-Threat Campaign
- Threat Actors Weaponize Tiflux RMMs in Malspam Attacks
- LOLRMM Project — Living-off-the-Land RMM Tools
- LOLDrivers Project — HwRwDrv.sys Entry
- Microsoft Recommended Driver Blocklist
- MITRE ATT&CK T1219 — Remote Access Tools / Remote Monitoring & Management
- MITRE ATT&CK T1068 — Exploitation for Privilege Escalation (BYOVD context)
- MITRE ATT&CK T1218.007 — Msiexec Signed Binary Proxy Execution
- Huntress — LOLRMM blog series (background reading)
Threats related to Tiflux RMM Triple-Threat Campaign
- Cross-Platform Phishing Campaigns Auto-Adapt Payloads to Victim Device/OS via Fingerprinting
- GPU-Targeted Cryptojacking Campaign — SEO + AI Chatbot Poisoning Delivers ScreenConnect & SimpleRunPE Process Hollowing into .NET Utilities (Microsoft Defender Experts)
- AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites)
- Operation BlueDash: Fake Microsoft Teams Update Deploys Dual RMM Backdoors (Level RMM + ScreenConnect)
- SynkLoader: New Multi-Module Malware Family Distributed via Microsoft Teams Phishing Campaign Targeting Enterprise Active Directory Environments
- The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
Detection coverage for TL-2026-0520
As of 2026-05-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0520 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.