Threat reportMalwareTL-2026-0790
Abuse of Legitimate NinjaOne RMM Agent in Fiscal-Lure Phishing Campaign Targeting Brazilian Organizations (Cato CTRL)
An active, previously undocumented phishing campaign abuses the legitimate NinjaOne RMM agent to gain hands-on-keyboard administrative access to Brazilian organizations. Victims in finance, procurement, and administrative roles are lured with fake Brazilian fiscal-document portals impersonating SEFAZ and Reclame Aqui, then convinced to install a genuine NinjaOne agent pre-configured to attacker-controlled infrastructure, evading traditional malware detection.
Key facts for NinjaOne RMM fiscal lure
| Identifiers | TL-2026-0790 |
|---|---|
| Also known as | NinjaOne RMM Abuse Chain (Cato CTRL), Brazilian Fiscal-Lure RMM Campaign |
| Severity | HIGH |
| Exploitation status | Exploited in the wild |
| Affected products | NinjaOne NinjaOne RMM Agent |
| Malware | Venon RAT |
| Tools | NinjaOne RMM Agent |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1027 Obfuscated Files or Information, T1036 Masquerading, T1041 Exfiltration Over C2 Channel, T1070 Indicator Removal, T1082 System Information Discovery, T1102 Web Service, T1105 Ingress Tool Transfer, T1204 User Execution, T1219 Remote Access Tools, T1497 Virtualization/Sandbox Evasion, T1518 Software Discovery and 5 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | chemicals, advanced materials, finance, procurement, accounting, administrative |
| Target regions | Brazil, South America |
| Detection rules | 9 (1 shown free) |
| Sources | 6 cited sources |
Detection coverage for NinjaOne RMM fiscal lure
As of 2026-06-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0790 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Fiscal-Document-Named RMM Installer Dropped/Executed (NinjaOne Masquerade) — Exploitation
Detects the initial-access stage of the NinjaOne fiscal-lure chain: a genuine but renamed NinjaOne RMM agent masqueraded as a Brazilian fiscal document (DocumentoFiscal<digits>, Documento-Sede-Auto) written to a user Downloads folder and executed. Fires on the masquerade filename pattern in Sysmon file-create (EventCode 11) and process-create (EventCode 1) telemetry, catching the user-execution of the malicious file before the agent enrolls.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1566.002, T1204.002, T1036.008, T1036.005
- Data sources: sysmon, microsoft_defender_endpoint, windows_security
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=11 OR EventCode=1)
| eval fname=coalesce(TargetFilename, Image)
| where (like(fname, "%\\Downloads\\%") OR EventCode=1)
| where match(fname, "(?i)(NinjaOne-Agent-Documento|DocumentoFiscal\d+|Documento.*Sede-Auto)")
| where match(fname, "(?i)\.exe$") OR EventCode=1
| stats count min(_time) as firstSeen max(_time) as lastSeen values(EventCode) as event_codes values(fname) as files by host, User
| convert ctime(firstSeen) ctime(lastSeen)
| `comment("Genuine signed NinjaOne agent renamed as a fiscal document = T1036.008/T1036.005 masquerade + T1204.002 user execution")`Microsoft KQL
// Fiscal-document-named RMM installer dropped or executed
let markers = dynamic(["NinjaOne-Agent-Documento","DocumentoFiscal","Sede-Auto"]);
union
(DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has "\\Downloads\\" and FileName endswith ".exe"
| where FileName has_any (markers)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountName, Action="file_drop", FileName, FolderPath),
(DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (markers) or ProcessCommandLine has_any (markers)
| project Timestamp, DeviceName, AccountUpn=AccountName, Action="process_exec", FileName, FolderPath)
| sort by Timestamp descSigma
title: Fiscal-Document-Named RMM Installer in Downloads (NinjaOne Masquerade)
id: 6f1c2a40-7b3e-4d51-9a02-0790a1b2c3d4
status: experimental
description: Detects a fiscal-document-named NinjaOne RMM agent (DocumentoFiscal/Sede-Auto) written to a Downloads folder, the masqueraded payload of the Cato CTRL Brazilian fiscal-lure RMM abuse chain.
references:
- https://www.catonetworks.com/blog/cato-ctrl-previously-undocumented-ninjaone-rmm-abuse-chain/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-14
tags:
- attack.initial_access
- attack.t1566.002
- attack.execution
- attack.t1204.002
- attack.defense_evasion
- attack.t1036.008
- attack.t1036.005
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|contains: '\Downloads\'
TargetFilename|contains:
- 'NinjaOne-Agent-Documento'
- 'DocumentoFiscal'
- 'Sede-Auto'
TargetFilename|endswith: '.exe'
condition: selection
falsepositives:
- Legitimate IT-sanctioned NinjaOne deployment that happens to use a documento-style filename (rare)
level: highKnown false positives:
- Sanctioned NinjaOne rollout using an unusual document-style installer name
- Security-team test/EICAR-style files mimicking the lure
Tuning notes: Exclude file paths under your sanctioned RMM deployment share or known IT staging accounts. Tighten the regex to your locale's fiscal-document naming if FP volume is high; add hash allowlisting once the genuine NinjaOne agent hash is known.
- Anti-Sandbox Fiscal Portal Fingerprinting & Honeypot Markers — Exploitation · unlock with TL Creds
- RMM Agent Discovery & Recon From Unmanaged Endpoint — Post-Exploitation · unlock with TL Creds
- Periodic RMM Beacon to Unsanctioned NinjaOne Tenant + Ingress Tool Transfer — C2 / Lateral · unlock with TL Creds
- Hidden-Iframe Payload Delivery & Indicator Removal on Fiscal Portal — Exploitation · unlock with TL Creds
- Linux RMM Masquerade + systemd Persistence (NinjaOne Abuse) — Post-Exploitation · unlock with TL Creds
- Callback-Phishing Relay via googleusercontent to Fiscal-Lure Domain — C2 / Lateral Enabler · unlock with TL Creds
- Unauthorized NinjaOne RMM Service Persistence on Unmanaged Host — Post-Exploitation · unlock with TL Creds
- Fiscal-Lure Portal & Unsanctioned RMM Tenant C2 Traffic — C2 / Lateral · unlock with TL Creds
Indicators of compromise for NinjaOne RMM fiscal lure
As of 2026-06-14, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-0790.
Sample indicators (3 of 21)
- Domain:
r64[.]org - Domain:
hairdb[.]com - Domain:
lazybearpottery[.]net
Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.
How NinjaOne RMM fiscal lure works
Cato CTRL documented a Brazil-focused social-engineering operation that weaponizes a legitimate Remote Monitoring and Management (RMM) tool rather than custom malware. The intrusion begins with routine-appearing phishing emails that redirect through Google infrastructure (bc.googleusercontent.com relay pattern) to Portuguese-language portals impersonating trusted Brazilian institutions — the SEFAZ state tax authority (via sefaz[.]services) and the Reclame Aqui consumer-complaint platform (via reclameaqui[.]services), alongside staging domains r64.org, hairdb.com, lazybearpottery.net, and rectalmania.com. The fake portals present 'secure document' / 'fiscal document' verification workflows aimed at procurement, finance, accounting, and administrative personnel who routinely handle supplier and tax paperwork. In some cases operators follow up by phone, guiding victims to install 'required software.'
The delivered file is a genuine NinjaOne RMM agent named to look like a fiscal document (e.g. NinjaOne-Agent-DocumentoFiscal21782856920262001238-Sede-Auto-x86-64). Because the binary is signed, legitimate, and common in enterprise environments, most endpoint and network controls do not flag it. Once installed, the agent is configured to call back to attacker-controlled NinjaOne tenancy/infrastructure, granting the operators administrative-level capabilities native to the platform: endpoint monitoring and reconnaissance, asset inventory, remote shell / command execution, file transfer (tool upload and data exfiltration), software deployment, patch management, and scripted automation — all blending into legitimate IT operations.
The campaign is wrapped in a sophisticated anti-analysis delivery layer. Payload delivery is geofenced to Brazilian IP ranges, limiting researcher visibility. Client-side JavaScript performs sandbox/automation detection (checks for Selenium, Puppeteer, Playwright, WebDriver, PhantomJS, and Nightmare), user-presence validation (mouse movement, scrolling, and touch interaction), and honeypot validation that flags automated form-fillers with the Portuguese marker 'Bot preencheu o honeypot.' The payload is served through a hidden iframe that is removed roughly 30 seconds after execution, right-click is disabled on download elements, and artifact-cleanup logic erases traces. Researchers pivoted on a shared Earth-themed wallpaper image (depicting the Americas) displayed by multiple attacker domains to expand visibility into the broader infrastructure. Cato CTRL observed command-and-control infrastructure and visual-asset overlaps with previously documented Venon RAT activity — a Brazilian, Rust-based RAT operation — suggesting a possible operational relationship or shared infrastructure, but stopped short of definitive attribution.
MITRE ATT&CK techniques by tactic:
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Execution
Persistence
T1543 Create or Modify System Process
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
Remediation for NinjaOne RMM fiscal lure
Immediate actions
- Block the published phishing/C2 domains (r64.org, hairdb.com, lazybearpottery.net, rectalmania.com, sefaz.services, reclameaqui.services) at DNS/web proxy and perimeter
- Alert finance, procurement, accounting, and administrative staff to the fiscal-document RMM lure and the phone-based install pressure
- Hunt endpoints for unauthorized or unmanaged NinjaOne RMM agent installations and unexpected NinjaOne tenant enrollments
Workarounds
- Restrict installation of RMM agents to managed deployment channels; deny user-initiated installs of remote-access software
- Treat any request to install software merely to 'view a document' as a security incident
Longer-term hardening
- Maintain an application allowlist of sanctioned RMM tools and tenants; alert on any RMM software outside the approved inventory (NinjaOne, AnyDesk, TeamViewer, Atera, ConnectWise, etc.)
- Deploy XDR/EDR with behavioral detection for RMM network signals and anomalous remote-management activity
- Implement web isolation / browser security to neutralize geofenced, fingerprinting phishing portals
Affected and fixed versions
- NinjaOne — NinjaOne RMM Agent
Vulnerable versions: legitimate agent abused as remote-access tooling
Timeline of NinjaOne RMM fiscal lure
- Cato CTRL identified the phishing infrastructure and confirmed locked-ioc-12 delivery via fake Brazilian fiscal-document portals.
- Cloudflare responded that it was unable to detect the abuse on the reported infrastructure and forwarded the report to the hosting owner, leaving the malicious flow operational.
- Cato CTRL reported the malicious URLs to Cloudflare under responsible disclosure; Cloudflare indicated the reported URLs were no longer accessible.
- Portions of the attacker infrastructure remained accessible despite the takedown report, indicating an active and resilient operation.
- Cato CTRL published its primary threat-research report documenting the previously undocumented NinjaOne RMM abuse chain, the fiscal-document lures, and the anti-analysis delivery layer.
- Researchers documented C2 infrastructure and visual-asset overlaps with prior locked-ioc-20 activity, suggesting a possible operational relationship without definitive attribution.
- Cato CTRL published the threat research detailing the NinjaOne RMM abuse chain; covered by Cyber Security News, GBHackers, and Cyberpress.
- Threadlinqs Intelligence documented the campaign as TL-2026-0790 for SOC detection, hunting, and IOC blocking.
Sources cited for NinjaOne RMM fiscal lure
- Cato CTRL Threat Research: From Fiscal Lures to Remote Access, A Previously Undocumented NinjaOne RMM Abuse Chain catonetworks.com · Research · 2026-06-12
- Cisco Talos: Spam campaign targeting Brazil abuses Remote Monitoring and Management tools (related RMM-abuse context) Cisco Talos · Research · 2026-01-01
- Hackers Abuse Legitimate NinjaOne RMM Software to Bypass Traditional Malware Detection cybersecuritynews.com · Blog · 2026-06-12
- Hackers Abuse Legitimate NinjaOne RMM Software (Cryptika mirror) cryptika.com · Blog · 2026-06-12
- Hackers Abuse NinjaOne RMM Agent to Gain Remote Access to Brazilian Organizations gbhackers.com · News · 2026-06-12
- Hackers Use Fake Fiscal Documents to Deliver NinjaOne RMM Agent for Remote Access cyberpress.org · News · 2026-06-12
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.
