# Tiflux RMM Triple-Threat Campaign — Service-Agreement Malspam Chains UltraVNC + Splashtop + ScreenConnect with BYOVD HwRwDrv.sys for Privilege Escalation

> An active malspam campaign tracked by the Huntress SOC since February 27, 2026 weaponizes Tiflux, a Brazilian commercial RMM, as the initial foothold for stealthy remote access against organizations primarily reached through fake service-agreement and document lures. The signed Tiflux .msi installer chains additional remote-control tools (UltraVNC, Splashtop, ScreenConnect), abuses a Bring-Your-Own-Vulnerable-Driver (BYOVD) component HwRwDrv.sys for privilege elevation, and contains hardcoded VNC credentials, Secure-Attention-Sequence-disabling registry payloads, and a hardcoded PuTTY SSH key for the operator's infrastructure (remote1a.peopleone.com.br). Observed outcomes include unauthorized access, system profiling via osquery, screenshot exfiltration, and credential theft.

- **Published:** 2026-05-17T12:00:00Z
- **Last reviewed:** 2026-05-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0520
- **ID:** TL-2026-0520
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning February 27, 2026 and escalating through May 2026, Huntress observed a recurring intrusion pattern across multiple managed customers in which threat actors abuse Tiflux — a lesser-known commercial RMM produced by Tiflux Sistema de Gestao LTDA (Brazil) — as the primary remote-control surface delivered via malspam. The campaign is notable not only for adopting another LOLRMM tool but for stacking three additional remote-control suites and a kernel-mode privilege-escalation driver inside a single signed .msi package, blurring the line between rogue install and legitimate Brazilian MSP tooling.

Initial Access (TA0001): Targets receive a phishing email purporting to share a service agreement or business document. A representative lure observed on May 1, 2026 was sent from businessservices@hg.lawdepotisland.com and linked to a Cloudflare-CAPTCHA-gated landing page at lenwillfilenetwork.com that redirected through a fake document-download page to deliver Network Solutions Agreement.msi. A second variant observed the following day used a fake CAPTCHA dialog that incongruously rendered macOS visual chrome inside Microsoft Edge on Windows before serving the same installer. Alternative payload URLs included https://anythinghere.woremix.icu/Viewfiles/download.php. The malicious installer is signed by Tiflux Sistema de Gestao LTDA, and Huntress observed signing timestamps just one day prior to analysis, suggesting either a recently-issued cert, abuse of an MSP build pipeline, or operator-controlled signing infrastructure.

Execution & Installation (TA0002): The .msi spawns msiexec.exe and lays down the standard Tiflux components (TiAgent, TiService, TiPeerToPeer, si.exe) plus three bundled 'dependencies' — UltraVNC, 7zip, and tar. Once TiService is registered and running, the Tiflux orchestrator uses its built-in software-push feature to download and install ScreenConnect and/or Splashtop with no user notification. Huntress observed both Tiflux and Splashtop services subsequently checking in to their respective control servers and Splashtop launching osqueryi.exe to enumerate host telemetry and OS-level state.

Persistence (TA0003): Tiflux installs itself as a Windows service (TiService) along with the third-party RMMs (Splashtop service, ScreenConnect service). Five .reg files bundled with the installer extend persistence: one adds a Services entry for TightVNC (under the nonstandard path C:\PeopleOne\dependencies\tightvnc\tvnserver.exe) with the SafeBoot flag set so the VNC service survives Safe Mode reboots. Another .reg adds a PuTTY SSH host key pinned to remote1a.peopleone.com.br, enabling passwordless SSH to operator infrastructure even though PuTTY itself is not installed by the campaign. UltraVNC drops the legacy 'mv video hook driver2' display adapter (originally published April 11, 2007) which persists in Device Manager.

Privilege Escalation (TA0004): The campaign drops the vulnerable driver HwRwDrv.x64 (HwRwDrv.sys) into the user's %TEMP% directory and registers it as a kernel driver. HwRwDrv exposes arbitrary physical-memory read/write primitives via IOCTL — it is a well-known BYOVD candidate present on LOLDrivers and on Microsoft's Vulnerable Driver Blocklist, enabling token-swap and kernel-memory-patch attacks to elevate from medium to SYSTEM/kernel. The driver's Authenticode signing certificate has been revoked for years; Windows displays a 'certificate revoked' status on the file's properties sheet, yet the driver still loads because Windows does not enforce revocation for already-trusted signers on most installations.

Defense Evasion (TA0005): Two of the bundled .reg files disable the Secure Attention Sequence (SAS) and suppress consent / notification prompts that would otherwise reveal interactive VNC sessions, allowing a remote operator to use the desktop without producing the visual cues a victim or local helpdesk would expect. The use of signed RMM installers (Tiflux, Splashtop, ScreenConnect, UltraVNC) lets the kill chain ride on legitimate digital signatures and bypass naive trust-based controls. Renaming the malicious .msi to Adobeclient-33.2.msi or 'Network Solutions Agreement.msi' frames the file as routine and helps avoid suspicion at the user.

Credential Access (TA0006): UltraVNC initialization .ini files inside the package contain two hardcoded VNC passwords stored as DES-encoded hex blobs which are trivially reversible using public tools, providing the operator a fallback authentication path even if the deployed install is altered. The TiPeerToPeer messaging component embeds a hardcoded secret key and beacons on 21116/udp to operator infrastructure. Observed incidents resulted in credential theft from compromised hosts.

Discovery & Collection (TA0007, TA0009): Splashtop on infected hosts executed osqueryi.exe to enumerate processes, services, network configuration, installed software, and accounts. Both Tiflux and Splashtop captured screenshots and screenshot thumbnails, transmitting them back to operator-controlled management consoles. The 32-bit UltraVNC .ini left a build-machine path string identifying a developer linked via OSINT to both Tiflux and 'PeopleOne', a Brazilian MSP brand.

Command and Control (TA0011): Three concurrent RMM control planes operate in parallel — Tiflux (Brazilian-hosted RMM cloud and TiPeerToPeer UDP/21116 to its backend), Splashtop (vendor cloud), and ScreenConnect (operator-controlled C2 at 84.54.33.192:8040 hosting ScreenConnect.ClientSetup.msi at /Bin/ScreenConnect.ClientSetup.msi). Operator-controlled domains include shankar.woremix.icu and anythinghere.woremix.icu (parent woremix.icu), plus the SSH-pinned remote1a.peopleone.com.br, which was offline at the time of Huntress publication on May 7, 2026.

Impact (TA0040): Huntress observed unauthorized interactive access, system enumeration, screenshot harvesting, and credential theft. The presence of HwRwDrv elevates the potential blast radius to kernel-mode tampering, AV/EDR neutralization, and lateral movement using stolen credentials. The chained, signed nature of the toolset makes the campaign disproportionately resistant to signature-based detection and underscores the need for application control (e.g., explicit allowlisting of authorized RMMs only) and Microsoft's Vulnerable Driver Blocklist enforcement.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1566 Phishing
- T1204 User Execution
- T1569 System Services
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1218 System Binary Proxy Execution
- T1553 Subvert Trust Controls
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1036 Masquerading
- T1564 Hide Artifacts
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1057 Process Discovery
- T1007 System Service Discovery
- T1113 Screen Capture
- T1219 Remote Access Tools
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Threat Actors Weaponize Tiflux RMMs in Malspam Attacks](https://www.huntress.com/blog/tiflux-rmm-install)
- [LOLRMM Project — Living-off-the-Land RMM Tools](https://lolrmm.io/)
- [LOLDrivers Project — HwRwDrv.sys Entry](https://www.loldrivers.io/)
- [Microsoft Recommended Driver Blocklist](https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules)
- [MITRE ATT&CK T1219 — Remote Access Tools / Remote Monitoring & Management](https://attack.mitre.org/techniques/T1219/)
- [MITRE ATT&CK T1068 — Exploitation for Privilege Escalation (BYOVD context)](https://attack.mitre.org/techniques/T1068/)
- [MITRE ATT&CK T1218.007 — Msiexec Signed Binary Proxy Execution](https://attack.mitre.org/techniques/T1218/007/)
- [Huntress — LOLRMM blog series (background reading)](https://www.huntress.com/blog?tag=remote-monitoring-management)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0520