Legitimate Remote Access Tool Abuse
Pattern definition
Attackers repackage, re-sign, or reconfigure legitimate remote-access software (ScreenConnect, NetSupport Manager, AnyDesk, TeamViewer) to establish persistent C2 without developing custom malware. The legitimate tool provides the remote-access capability; the attacker's contribution is the delivery mechanism, the signing certificate, and the C2 infrastructure.
Variants observed in this corpus
| Family | Tool abused | Delivery mechanism | Signing |
|---|---|---|---|
| connectwise | ScreenConnect | ClickOnce bootstrapper or MSI bundle | Stolen/compromised ConnectWise Authenticode |
| netsupport-inno-dropper | NetSupport Manager | Inno Setup installer repackaging | Stolen Sectigo cert |
| anydesk-batch-dropper | AnyDesk | Batch-script stager + WinRAR | None (bare batch) |
Why it works
- The remote-access tool itself is not malicious — it won't trigger AV heuristics.
- If signed, it bypasses SmartScreen and reputation-based filters.
- The tool's legitimate network traffic blends with enterprise remote-support traffic.
- Persistence, keylogging, and screen capture are built-in features, not post-exploitation implants.
Cross-references
- techniques/clickonce-certificate-trust-bootstrap — Certificate-trust evasion specific to ClickOnce delivery
- entities/connectwise.md — ConnectWise ScreenConnect abuse cluster
- entities/netsupport-inno-dropper.md — NetSupport Manager abuse cluster