Topic

Remote management tool abuse

Deployment of legitimate remote monitoring and management software, here ManageEngine, as post-exploitation persistence and control.

Current clusters

build1 distinct publisher

Spring Ring stands up an onmicrosoft.com tenant to place the IT help-desk call

Unit 42 traced two campaigns that open with a Teams chat and an immediate voice call from an external tenant, which puts the question of who can ring your staff in the same bucket as who can sign in as them.

Publishers:dev.to

Reality

Evidence42
Adoption27
Hype gap+9
Incentives58

build1 distinct publisher

TA4922 parks Donut Loader in the same folder as a signed executable

Proofpoint's PackClient writeup describes a chain whose only attacker-supplied executable on disk is a DLL, and whose persistence arrives as a real ManageEngine agent. That leaves the detection sitting on load-event correlation and egress control.

Publishers:dev.to

Reality

Evidence36
Adoption31