# Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709

> Acronis TRU telemetry from over 1.8 million Acronis RMM endpoints (EDR incidents Jan 2025 - Mar 2026) shows 63.1% of endpoints carry at least one additional RMM or remote access tool, while attackers deploy or hijack legitimate and open-source remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP) to blend in with normal traffic. A compromised MSP management platform can expose many customer environments, as illustrated by the November 2026 N-able N-central disclosure.

- **Published:** 2026-11-12T03:40:27Z
- **Last reviewed:** 2026-11-12T03:40:27Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5819
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5819.png
- **ID:** TL-2026-5819
- **Severity:** HIGH (CVSS 10)
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Andariel (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)
- **CVEs:** CVE-2024-1709, CVE-2026-125878, CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882, CVE-2026-125883, CVE-2026-91000

## Description

Acronis Threat Research Unit (TRU) published part one of a two-part analysis (2026-11-10) of RMM and remote access tool risk for small and midsized businesses. The dataset covers over 1.8 million endpoints running Acronis RMM and cyber protection, with EDR incidents from January 2025 through March 2026. The article notes that inventory and incident datasets measure different things and that the figures are not per-installation compromise rates; increased EDR deployment may also contribute to rising detections.

Inventory findings: 36% of endpoints have only one RMM product (Acronis RMM) and 63.1% have at least one additional RMM or remote access tool. Over a third have three or more tools, and some have four or five. TeamViewer is on over 16% of endpoints and ConnectWise ScreenConnect on 9%. Combinations include Acronis RMM with TeamViewer (8% of devices), ConnectWise, Datto, NinjaOne, and open-source or self-hosted tools such as VNC, RustDesk, MeshCentral and TacticalRMM.

Malicious incident data: RDP accounts for about 26% of remote-access-related malicious EDR incidents (402 in September 2025, 39 in February 2026, 380 in March 2026). MeshAgent produced 1,178 incidents from September 2025 to March 2026, about 8 times the number of recorded installations. Ammyy Admin incidents were about 153 times recorded installations. ScreenConnect installations outnumbered incidents 604 to 1 and AnyDesk 1,591 to 1, but in one example a compromised MSP using ScreenConnect generated hundreds of incidents across its client base within hours. Acronis states that attackers abuse already-installed approved tools, use RDP after initial access without installing another tool, and use RMM remote desktop, command execution and file transfer to introduce additional payloads. MeshAgent features cited include encrypted communication, NAT traversal without port forwarding, and desktop and shell access.

Attribution context in the article: Andariel (North Korea-linked) and unnamed Iranian-linked actors are mentioned as using MeshAgent in campaigns; TA505 used FlawedAmmyy RAT built from leaked Ammyy Admin v3 source code (Proofpoint, 2018: spoofed-sender spam with macro documents and ZIP/.url files, JavaScript downloading Quant Loader which deploys FlawedAmmyy, C2 over HTTP port 443, stolen/abused code-signing certificates). A Proofpoint Virus Bulletin 2025 abstract reports at least 10 RMM tools regularly seen in email campaigns versus 2-3 from 2022 to mid-2024. Acronis TRU's September 2025 investigation of trojanized ScreenConnect installers (campaigns rising since March 2025, mostly targeting U.S. organizations) documented a ClickOnce lure launching ScreenConnect.ClientSetup.exe against an attacker-controlled server, followed by ScreenConnect-delivered AsyncRAT, a custom PowerShell RAT and PureHVNC (process hollowing into RegAsm.exe), with persistence via scheduled tasks and Startup-folder scripts. AnyDesk disclosed a production-system breach in February 2024 (reported source code and code-signing certificate theft).

Vulnerability context: CVE-2024-1709 is a critical (CVSS 10.0, CWE-288) ScreenConnect authentication bypass affecting 23.9.7 and prior, fixed in 23.9.8 and added to CISA KEV on 2024-02-22; ConnectWise published IOCs on 2024-02-20. The Acronis Cyberthreats Report H2 2025 counted 8 N-able RMM vulnerabilities, 2 for ScreenConnect, 2 for AnyDesk and 19 TeamViewer CVEs (2 critical) in 2025; Acronis cautions these are not a product security ranking. In November 2026 N-able took hosted N-central offline on 2026-11-09 after an independent researcher published 33 critical vulnerabilities to GitHub (Huntress: four 'Able2Shell' chains - three RCE, one root privilege escalation). N-central 2026.4 Hotfix 2 (build 2026.4.1.26) was released 2026-11-10 fixing XXE, OGNL injection, syslog-ng local privilege escalation, stored XSS, SSRF, upload path traversal RCE and insecure IPC issues. N-able observed scanning tied to the public exploit code but reported no evidence of successful exploitation of customer environments, and Huntress had not observed Able2Shell exploitation in partner environments. No IOCs are published in the Acronis article itself; network and file IOCs below come from the cited ConnectWise bulletin, Acronis TRU trojanized-ScreenConnect report and Proofpoint FlawedAmmyy report.

## MITRE ATT&CK

- T1219.002 Remote Access Tools: Remote Desktop Software
- T1021.001 Remote Services: Remote Desktop Protocol
- T1199 Trusted Relationship
- T1190 Exploit Public-Facing Application
- T1566.001 Phishing: Spearphishing Attachment
- T1078 Valid Accounts
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1055.012 Process Injection: Process Hollowing
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1553.002 Subvert Trust Controls: Code Signing
- T1071.001 Application Layer Protocol: Web Protocols
- T1518.001 Software Discovery: Security Software Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized ScreenConnect Persistence — Skype Updater Task, Public Script Staging, Startup Folder JS — Post-Exploitation** (`TL-2026-5819-SPL-002`)

Detects persistence and staging artifacts from the trojanized ScreenConnect campaign: scheduled task 'Skype Updater' running C:\Users\Public\Ab.vbs (AsyncRAT v2), NvContainerRecovery.ps1 staged for PureHVNC, and FirefoxUpdate.js dropped into the Startup folder (PowerShell RAT).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1547.001, T1059.005, T1059.007
- **Data sources:** sysmon, windows_security, DeviceProcessEvents, DeviceFileEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" earliest=-24h ((EventCode=1 ((Image="*\\schtasks.exe" CommandLine="*/create*" (CommandLine="*Skype Updater*" OR CommandLine="*\\Users\\Public\\*")) OR (Image IN ("*\\wscript.exe","*\\cscript.exe","*\\powershell.exe") (CommandLine="*\\Users\\Public\\Ab.vbs*" OR CommandLine="*NvContainerRecovery.ps1*" OR CommandLine="*FirefoxUpdate.js*")))) OR (EventCode=11 (TargetFilename="*\\Users\\Public\\Ab.vbs" OR TargetFilename="*\\Users\\Public\\NvContainerRecovery.ps1" OR TargetFilename="*\\Start Menu\\Programs\\Startup\\FirefoxUpdate.js")))
| eval artifact=coalesce(TargetFilename, CommandLine)
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(EventCode) as event_codes values(artifact) as artifacts values(ParentImage) as parents by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let proc = DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "schtasks.exe" and ProcessCommandLine has "/create" and (ProcessCommandLine has "Skype Updater" or ProcessCommandLine has @"\Users\Public\"))
    or (FileName in~ ("wscript.exe","cscript.exe","powershell.exe") and ProcessCommandLine has_any (@"\Users\Public\Ab.vbs","NvContainerRecovery.ps1","FirefoxUpdate.js"))
| project Timestamp, DeviceName, AccountName, Source="process", Artifact=ProcessCommandLine, InitiatingProcessFileName;
let files = DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated","FileModified")
| where (FileName in~ ("Ab.vbs","NvContainerRecovery.ps1") and FolderPath has @"\Users\Public\")
    or (FileName =~ "FirefoxUpdate.js" and FolderPath has @"\Startup\")
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, Source="file", Artifact=FolderPath, InitiatingProcessFileName;
union proc, files
| sort by Timestamp desc
```

### Sigma

```yaml
title: Trojanized ScreenConnect Persistence via Skype Updater Task and Public Folder Scripts
id: 8e4a2c91-6b07-4d3f-a5c8-1f2e3d4c5b02
status: experimental
description: Detects scheduled task creation and script launches tied to the trojanized ScreenConnect campaign such as Skype Updater, Ab.vbs, NvContainerRecovery.ps1 and FirefoxUpdate.js (TL-2026-5819)
references:
    - https://www.acronis.com/en/tru/posts/the-remote-access-blind-spot-an-analysis-of-rmm-tool-risk-for-smbs/
    - https://www.acronis.com/en/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/
author: Threadlinqs Team
date: 2026/11/12
tags:
    - attack.persistence
    - attack.execution
    - attack.t1053.005
    - attack.t1547.001
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_taskdata:
        CommandLine|contains:
            - 'Skype Updater'
            - '\Users\Public\'
    selection_script:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - '\Users\Public\Ab.vbs'
            - 'NvContainerRecovery.ps1'
            - 'FirefoxUpdate.js'
    condition: (selection_schtasks and selection_taskdata) or selection_script
falsepositives:
    - Administrators legitimately scheduling scripts out of the Public profile folder
    - Software deployment tools creating tasks that reference the Public profile
level: high

```

**Known false positives:**

- Admin scripts or deployment tools scheduling tasks from C:\Users\Public
- Legitimate software that names a task 'Skype Updater'

**Tuning notes:** Baseline scheduled tasks that reference C:\Users\Public and allowlist approved deployment tooling. The named artifacts (Ab.vbs, NvContainerRecovery.ps1, FirefoxUpdate.js) are high-fidelity; the generic Public-path clause is the noisier branch and can be removed if needed.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized ScreenConnect ClickOnce Lure and Attacker-Controlled Relay — Initial Execution (locked: unlock with TL Creds)
- PowerShell RAT Loader, AMSI Bypass and ScreenConnect-Spawned Encoded PowerShell — Post-Exploitation (locked: unlock with TL Creds)
- RegAsm.exe Process Hollowing — PureHVNC Outbound Public Network Connection — C2 Phase (locked: unlock with TL Creds)
- MeshAgent Remote Access Tool Execution or Installation — Abuse of Open-Source RMM (locked: unlock with TL Creds)
- Ammyy Admin / FlawedAmmyy Binary Execution — TA505 Remote Access (locked: unlock with TL Creds)
- RDP Newly Enabled via fDenyTSConnections Registry Change — Lateral Movement Preparation (locked: unlock with TL Creds)
- ScreenConnect CVE-2024-1709 SetupWizard Auth Bypass and Known Exploitation IPs — Exploitation Phase (locked: unlock with TL Creds)
- RMM/RAT C2 Infrastructure — rovider.net, AsyncRAT, PureHVNC and FlawedAmmyy Indicators — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `155.133.5[.]15`
- Domain: `morco[.]rovider[.]net`
- URL: `hxxps://guilloton[.]fr/x.zip`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The remote access blind spot: An analysis of RMM tool risk for SMBs (Acronis TRU, part one)](https://www.acronis.com/en/tru/posts/the-remote-access-blind-spot-an-analysis-of-rmm-tool-risk-for-smbs/)
- [Remote access hardening playbook: reducing RMM tool risk for SMBs (Acronis TRU, part two)](https://www.acronis.com/en/tru/posts/remote-access-hardening-playbook-reducing-rmm-tool-risk-for-smbs/)
- [N-able N-central 2026.4 Hotfix 2 release notes](https://status.n-able.com/2026/11/10/n-central-2026-4-hf2-release-notes/)
- [Huntress: N-able disables cloud services following disclosure of Able2Shell exploit chains](https://www.huntress.com/blog/n-able-disables-cloud-services-following-disclosure-of-able2shell-exploit-chains)
- [ConnectWise ScreenConnect 23.9.8 security bulletin (CVE-2024-1709)](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8)
- [Acronis TRU: Trojanized ScreenConnect installers evolve, dropping multiple RATs on a single machine](https://www.acronis.com/en/tru/posts/trojanized-screenconnect-installers-evolve-dropping-multiple-rats-on-a-single-machine/)
- [Proofpoint: Leaked Ammyy Admin source code turned into malware (FlawedAmmyy / TA505)](https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware)
- [Virus Bulletin VB2025 (Proofpoint): Goodbye loaders, hello RMM - the rise of legit software in eCrime campaigns](https://virusbulletin.com/conference/vb2025/abstracts/goodbye-loaders-hello-rmm-rise-legit-software-ecrime-campaigns/)
- [Acronis Cyberthreats Report H2 2025](https://www.acronis.com/en/resource-center/resource/acronis-cyberthreats-report-h2-2025/)
- [BleepingComputer: AnyDesk says hackers breached its production servers](https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5819