Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5819 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Trojanized ScreenConnect Persistence — Skype Updater Task, Public Script Staging, Startup Folder JS — Post-Exploitation

Detects persistence and staging artifacts from the trojanized ScreenConnect campaign: scheduled task 'Skype Updater' running C:\Users\Public\Ab.vbs (AsyncRAT v2), NvContainerRecovery.ps1 staged for PureHVNC, and FirefoxUpdate.js dropped into the Startup folder (PowerShell RAT).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1547.001, T1059.005, T1059.007
• Data sources: sysmon, windows_security, DeviceProcessEvents, DeviceFileEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 ((Image="*\\schtasks.exe" CommandLine="*/create*" (CommandLine="*Skype Updater*" OR CommandLine="*\\Users\\Public\\*")) OR (Image IN ("*\\wscript.exe","*\\cscript.exe","*\\powershell.exe") (CommandLine="*\\Users\\Public\\Ab.vbs*" OR CommandLine="*NvContainerRecovery.ps1*" OR CommandLine="*FirefoxUpdate.js*")))) OR (EventCode=11 (TargetFilename="*\\Users\\Public\\Ab.vbs" OR TargetFilename="*\\Users\\Public\\NvContainerRecovery.ps1" OR TargetFilename="*\\Start Menu\\Programs\\Startup\\FirefoxUpdate.js")))
| eval artifact=coalesce(TargetFilename, CommandLine)
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(EventCode) as event_codes values(artifact) as artifacts values(ParentImage) as parents by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let proc = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "schtasks.exe" and ProcessCommandLine has "/create" and (ProcessCommandLine has "Skype Updater" or ProcessCommandLine has @"\Users\Public\"))
    or (FileName in~ ("wscript.exe","cscript.exe","powershell.exe") and ProcessCommandLine has_any (@"\Users\Public\Ab.vbs","NvContainerRecovery.ps1","FirefoxUpdate.js"))
| project Timestamp, DeviceName, AccountName, Source="process", Artifact=ProcessCommandLine, InitiatingProcessFileName;
let files = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated","FileModified")
| where (FileName in~ ("Ab.vbs","NvContainerRecovery.ps1") and FolderPath has @"\Users\Public\")
    or (FileName =~ "FirefoxUpdate.js" and FolderPath has @"\Startup\")
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Source="file", Artifact=FolderPath, InitiatingProcessFileName;
union proc, files
| sort by Timestamp desc

Sigma

title: Trojanized ScreenConnect Persistence via Skype Updater Task and Public Folder Scripts
id: 8e4a2c91-6b07-4d3f-a5c8-1f2e3d4c5b02
status: experimental
description: Detects scheduled task creation and script launches tied to the trojanized ScreenConnect campaign such as Skype Updater, Ab.vbs, NvContainerRecovery.ps1 and FirefoxUpdate.js (TL-2026-5819)
references:
    - https://www.acronis.com/en/tru/posts/the-remote-access-blind-spot-an-analysis-of-rmm-tool-risk-for-smbs/
    - https://www.acronis.com/en/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.persistence
    - attack.execution
    - attack.t1053.005
    - attack.t1547.001
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_taskdata:
        CommandLine|contains:
            - 'Skype Updater'
            - '\Users\Public\'
    selection_script:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - '\Users\Public\Ab.vbs'
            - 'NvContainerRecovery.ps1'
            - 'FirefoxUpdate.js'
    condition: (selection_schtasks and selection_taskdata) or selection_script
falsepositives:
    - Administrators legitimately scheduling scripts out of the Public profile folder
    - Software deployment tools creating tasks that reference the Public profile
level: high

Known false positives:

• Admin scripts or deployment tools scheduling tasks from C:\Users\Public
• Legitimate software that names a task 'Skype Updater'

Tuning notes: Baseline scheduled tasks that reference C:\Users\Public and allowlist approved deployment tooling. The named artifacts (Ab.vbs, NvContainerRecovery.ps1, FirefoxUpdate.js) are high-fidelity; the generic Public-path clause is the noisier branch and can be removed if needed.

• 🔒 Trojanized ScreenConnect ClickOnce Lure and Attacker-Controlled Relay — Initial Execution · unlock with TL Creds
• 🔒 PowerShell RAT Loader, AMSI Bypass and ScreenConnect-Spawned Encoded PowerShell — Post-Exploitation · unlock with TL Creds
• 🔒 RegAsm.exe Process Hollowing — PureHVNC Outbound Public Network Connection — C2 Phase · unlock with TL Creds
• 🔒 MeshAgent Remote Access Tool Execution or Installation — Abuse of Open-Source RMM · unlock with TL Creds
• 🔒 Ammyy Admin / FlawedAmmyy Binary Execution — TA505 Remote Access · unlock with TL Creds
• 🔒 RDP Newly Enabled via fDenyTSConnections Registry Change — Lateral Movement Preparation · unlock with TL Creds
• 🔒 ScreenConnect CVE-2024-1709 SetupWizard Auth Bypass and Known Exploitation IPs — Exploitation Phase · unlock with TL Creds
• 🔒 RMM/RAT C2 Infrastructure — rovider.net, AsyncRAT, PureHVNC and FlawedAmmyy Indicators — C2 Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5819.

Sample indicators (3 of 30)

• IP address: 155.133.5[.]15
• Domain: morco[.]rovider[.]net
• URL: hxxps://guilloton[.]fr/x.zip

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Technical analysis

A compromised MSP management platform can expose many customer environments, as illustrated by the November 2026 N-able N-central disclosure.

Acronis Threat Research Unit (TRU) published part one of a two-part analysis (2026-11-10) of RMM and remote access tool risk for small and midsized businesses. The dataset covers over 1.8 million endpoints running Acronis RMM and cyber protection, with EDR incidents from January 2025 through March 2026. The article notes that inventory and incident datasets measure different things and that the figures are not per-installation compromise rates; increased EDR deployment may also contribute to rising detections.

Inventory findings: 36% of endpoints have only one RMM product (Acronis RMM) and 63.1% have at least one additional RMM or remote access tool. Over a third have three or more tools, and some have four or five. TeamViewer is on over 16% of endpoints and ConnectWise ScreenConnect on 9%. Combinations include Acronis RMM with TeamViewer (8% of devices), ConnectWise, Datto, NinjaOne, and open-source or self-hosted tools such as VNC, RustDesk, MeshCentral and TacticalRMM.

Malicious incident data: RDP accounts for about 26% of remote-access-related malicious EDR incidents (402 in September 2025, 39 in February 2026, 380 in March 2026). MeshAgent produced 1,178 incidents from September 2025 to March 2026, about 8 times the number of recorded installations. Ammyy Admin incidents were about 153 times recorded installations. ScreenConnect installations outnumbered incidents 604 to 1 and AnyDesk 1,591 to 1, but in one example a compromised MSP using ScreenConnect generated hundreds of incidents across its client base within hours. Acronis states that attackers abuse already-installed approved tools, use RDP after initial access without installing another tool, and use RMM remote desktop, command execution and file transfer to introduce additional payloads. MeshAgent features cited include encrypted communication, NAT traversal without port forwarding, and desktop and shell access.

Attribution context in the article: Andariel (North Korea-linked) and unnamed Iranian-linked actors are mentioned as using MeshAgent in campaigns; TA505 used FlawedAmmyy RAT built from leaked Ammyy Admin v3 source code (Proofpoint, 2018: spoofed-sender spam with macro documents and ZIP/.url files, JavaScript downloading Quant Loader which deploys FlawedAmmyy, C2 over HTTP port 443, stolen/abused code-signing certificates). A Proofpoint Virus Bulletin 2025 abstract reports at least 10 RMM tools regularly seen in email campaigns versus 2-3 from 2022 to mid-2024. Acronis TRU's September 2025 investigation of trojanized ScreenConnect installers (campaigns rising since March 2025, mostly targeting U.S. organizations) documented a ClickOnce lure launching ScreenConnect.ClientSetup.exe against an attacker-controlled server, followed by ScreenConnect-delivered AsyncRAT, a custom PowerShell RAT and PureHVNC (process hollowing into RegAsm.exe), with persistence via scheduled tasks and Startup-folder scripts. AnyDesk disclosed a production-system breach in February 2024 (reported source code and code-signing certificate theft).

Vulnerability context: CVE-2024-1709 is a critical (CVSS 10.0, CWE-288) ScreenConnect authentication bypass affecting 23.9.7 and prior, fixed in 23.9.8 and added to CISA KEV on 2024-02-22; ConnectWise published IOCs on 2024-02-20. The Acronis Cyberthreats Report H2 2025 counted 8 N-able RMM vulnerabilities, 2 for ScreenConnect, 2 for AnyDesk and 19 TeamViewer CVEs (2 critical) in 2025; Acronis cautions these are not a product security ranking. In November 2026 N-able took hosted N-central offline on 2026-11-09 after an independent researcher published 33 critical vulnerabilities to GitHub (Huntress: four 'Able2Shell' chains - three RCE, one root privilege escalation). N-central 2026.4 Hotfix 2 (build 2026.4.1.26) was released 2026-11-10 fixing XXE, OGNL injection, syslog-ng local privilege escalation, stored XSS, SSRF, upload path traversal RCE and insecure IPC issues. N-able observed scanning tied to the public exploit code but reported no evidence of successful exploitation of customer environments, and Huntress had not observed Able2Shell exploitation in partner environments. No IOCs are published in the Acronis article itself; network and file IOCs below come from the cited ConnectWise bulletin, Acronis TRU trojanized-ScreenConnect report and Proofpoint FlawedAmmyy report.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1055.012 Process Injection: Process Hollowing; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219.002 Remote Access Tools: Remote Desktop Software

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566.001 Phishing: Spearphishing Attachment

Discovery

T1518.001 Software Discovery: Security Software Discovery

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing; T1685 Disable or Modify Tools

Remediation

Patches

• ConnectWise ScreenConnect 23.9.8 or later (CVE-2024-1709); interim 22.4.20001 for partners off maintenance
• N-able N-central 2026.4 Hotfix 2 (build 2026.4.1.26); upgrade Agents first, then Probes

Immediate actions

• Inventory all remote access and RMM tools on every endpoint and assign an owner, purpose and maintenance status to each installation
• Investigate unexpected MeshAgent or Ammyy Admin detections promptly
• For ScreenConnect alerts, verify the endpoint should have the agent and which server controls it
• For RDP incidents, review account use, whether the service was newly enabled, and other activity on affected hosts
• On-premises N-central: take the server offline until upgraded to 2026.4 HF2; review login and authentication activity from 2026-11-08 onward for unauthorized access
• Hunt for anomalous remote access sessions, newly deployed scripts and unauthorized new administrator accounts

Workarounds

• Track vendor security notices and keep remote access software updated
• Hosted N-central: follow N-able status page and restore only after N-able confirms servers are safe

Longer-term hardening

• Remove remote access tools that are no longer needed, such as agents left after a provider change
• Review who can use remote access tools and control privileged accounts
• Limit how far a compromised identity or management system can reach
• Plan for management infrastructure becoming unavailable, including recovery capabilities
• Do not rely on filtering for a single product; examine tool installation history and connecting servers, not just the alert

Affected and fixed versions

• ConnectWise — ScreenConnect
  Vulnerable versions: 23.9.7 and prior (CVE-2024-1709)
  Fixed in: 23.9.8 or later
• N-able — N-central
  Vulnerable versions: 2026.4.0.31 and likely earlier versions
  Fixed in: 2026.4 Hotfix 2 (2026.4.1.26)
• MeshCentral — MeshAgent (abused legitimate tool)
• Ammyy — Ammyy Admin (abused legitimate tool)

Timeline

• 2018-01-16 Proofpoint-documented narrow TA505 attack (automotive industry) delivers FlawedAmmyy, a RAT built from leaked Ammyy Admin v3 source, via macro-enabled document
• 2018-03-05 Mass spam with ZIP/.url files spoofing the recipient's domain; JavaScript downloads Quant Loader which deploys FlawedAmmyy
• 2024-02-19 ConnectWise releases ScreenConnect 23.9.8 and publishes bulletin for CVE-2024-1709 (CVSS 10.0 auth bypass) and CVE-2024-1708
• 2024-02-20 ConnectWise publishes indicators of compromise for the ScreenConnect vulnerabilities
• 2024-02-22 CISA adds CVE-2024-1709 to the Known Exploited Vulnerabilities catalog
• 2025-03-01 Acronis TRU reports trojanized ScreenConnect installer campaigns rising since March 2025, mostly targeting U.S. organizations; attack progression (AsyncRAT, PowerShell RAT, PureHVNC) spans about two months
• 2025-09-03 Acronis TRU publishes investigation of trojanized ScreenConnect installers dropping multiple RATs on a single machine
• 2026-11-09 N-able takes hosted N-central offline after an independent researcher publishes 33 critical vulnerabilities (Able2Shell chains) to GitHub; scanning tied to the PoC observed, no confirmed customer exploitation
• 2026-11-10 Acronis TRU publishes part one of its RMM tool risk analysis: 63.1% of 1.8M endpoints run an additional remote access tool; MeshAgent 1,178 incidents Sep 2025 - Mar 2026
• 2026-11-10 N-able releases N-central 2026.4 Hotfix 2 (build 2026.4.1.26); hosted servers upgraded and restored

Sources cited

• The remote access blind spot: An analysis of RMM tool risk for SMBs (Acronis TRU, part one) acronis.com · Research · 2026-11-10
• Remote access hardening playbook: reducing RMM tool risk for SMBs (Acronis TRU, part two) acronis.com · Research
• N-able N-central 2026.4 Hotfix 2 release notes status.n-able.com · Vendor report · 2026-11-10
• ConnectWise ScreenConnect 23.9.8 security bulletin (CVE-2024-1709) connectwise.com · Vendor report · 2024-02-19
• Acronis TRU: Trojanized ScreenConnect installers evolve, dropping multiple RATs on a single machine acronis.com · Research · 2025-09-03
• Proofpoint: Leaked Ammyy Admin source code turned into malware (FlawedAmmyy / TA505) Proofpoint · Research
• Virus Bulletin VB2025 (Proofpoint): Goodbye loaders, hello RMM - the rise of legit software in eCrime campaigns virusbulletin.com · Research
• Acronis Cyberthreats Report H2 2025 acronis.com · Research
• Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains Huntress · Blog · 2026-11-09
• BleepingComputer: AnyDesk says hackers breached its production servers BleepingComputer · News

More in threat intel

• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)
• ~45 Open-Source AI Hacking Frameworks Mapped; Hundreds of Agent Attack Consoles Exposed Online (ARTEX Family)
• Vulnerability backlog risk: nearly half of large-enterprise security teams close or deprioritize unverified findings (ProjectDiscovery survey)

More from Andariel

• North Korean Lazarus (Operation DreamJob) and DeceptiveDevelopment Target Drone Technology and Software Supply Chains
• North Korea-aligned Lazarus Targets Drone Sector (ScoringMathTea via BinMergeLoader) and DeceptiveDevelopment Targets Software Repositories (ESET APT Activity Report Q2-Q3 2026)
• The Mac Malware of 2023: macOS Ransomware, Stealers, and DPRK/Iran-Linked APT Malware (Objective-See Annual Review)
• North Korean Threat Actors Operationalize AI Across Tradecraft (Jade/Coral/Jasper/Diamond/Onyx/Pearl/Sapphire/Emerald Sleet; ProcmacSteal)
• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations

Other reports on CVE-2024-1709

• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)
• Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
• Capita Black Basta Ransomware Incident (March 2023) — Record £14M UK ICO Fine for 6M+ Affected Individuals
• The Remote Access Blind Spot: Acronis TRU Analysis of RMM Tool Proliferation and Abuse Risk in SMB Environments
• ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) Added to CISA KEV — Storm-1175 / Medusa Ransomware Active Exploitation
• Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi

Other reports on CVE-2026-125878

• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline