Ransomware operators have shifted from opportunistic malware distribution to highly targeted campaigns that exploit legitimate software for stealth and persistence.

Emerging in early 2025, several ransomware families began abusing popular remote access tools—such as AnyDesk and Splashtop—to establish footholds within enterprise networks.

By hijacking or silently installing these utilities, adversaries bypass security controls that traditionally trust signed installers, enabling initial access without tripping conventional detection mechanisms.

Organizations rapidly discovered anomalous remote sessions connecting from unexpected geolocations.

Seqrite analysts identified that attackers leveraged credential stuffing and phishing to obtain privileged accounts, then deployed remote access tools to move laterally.

Rather than relying solely on custom malware binaries, threat actors used existing administration frameworks to blend malicious activity into everyday IT operations, rendering their actions practically invisible to legacy endpoint protections.

The impact of these campaigns has been profound. Victims report encrypted file shares, disabled backups, and altered Remote Access Tool credentials to lock out administrators.

In high-profile intrusions attributed to LockBit and Black Basta variants, attackers combined RAT abuse with file-shredding commands to eradicate forensic traces, extend dwell time, and maximize ransom demands.

Organizations suffered costly downtime and data loss, underscoring the urgency of reevaluating trust in routine IT utilities.

Persistence Tactics of Remote Access Tool Abuse

A critical enabler of these ransomware operations is the attackers’ ability to maintain persistent control through run-of-the-mill remote administration software.

Two primary methods emerged: hijacking preinstalled tools to avoid file creation and deploying lightweight installers via command-line flags.

In the hijacking scenario, adversaries enumerate installed applications through Windows Management Instrumentation or PowerShell, then inject malicious credentials or modify JSON configuration files to grant unattended access under the attacker’s account.

This approach leaves no new executables on disk and evades antivirus scanning by abusing trusted executables already whitelisted in enterprise policies.

When opportunistic targets lack preexisting remote access utilities, attackers fall back on silent installation.

Using known installer parameters, they deploy signed binaries with minimal noise:-

Start-Process -FilePath '.\AnyDesk.exe' -ArgumentList 'INSTALL=C','STARTWITHWINDOWS=1','SILENT=1' -NoNewWindow

This command installs AnyDesk as a service that launches at boot, granting the adversary persistent entry points for follow-on operations.

Similar flags—such as VERYSILENT and NORESTART—are documented in vendor manuals yet rarely monitored by defenders.

Once embedded, the remote tool runs with elevated privileges if attackers escalate via utilities like TrustedInstaller or PowerRun.

Combined with registry run-key manipulation and hidden scheduled tasks, this chain ensures that even if an incident responder removes one backdoor, a secondary access path remains.

This layered persistence model frustrates remediation efforts and demands a shift toward behavior-based monitoring that flags anomalous tool usage rather than file signatures.

By abusing trusted remote administration software, ransomware gangs have turned IT convenience into their most potent weapon.

Defenders must implement strict application whitelisting, enforce multi-factor authentication, and monitor command-line arguments associated with common remote access tools to detect and disrupt these stealthy persistence tactics before encryption can occur.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Ransomware Gangs Leverage Remote Access Tools to Gain Persistence and Evade Defenses appeared first on Cyber Security News.

In recent months, security researchers have turned their attention to Asgard Protector, a sophisticated crypter employed by cybercriminals to obfuscate and deploy malicious payloads.

First advertised on underground forums in late 2023, Asgard Protector has gained traction among threat actors for its seamless integration with popular C2 platforms such as LummaC2.

By wrapping infostealers and remote access trojans within seemingly benign installers, Asgard Protector undermines traditional antivirus defenses and complicates incident response efforts.

The toolkit typically arrives as a Nullsoft self-extracting archive that, upon execution, unpacks several hidden components into the temporary directory.

SpyCloud analysts noted that this installer disguises its batch script with mismatched file extensions—for example, renaming a .bat file to Belgium.pst—and employs obfuscation techniques to hide its true purpose.

Once extracted, the installer assembles an AutoIt interpreter binary in memory, leveraging pieces from embedded CAB archives to reconstruct the executable before launching the next stage.

SpyCloud analysts identified additional layers of evasion within the embedded AutoIt scripts. Encrypted payloads are stored inside the script and only decrypted in memory using an RC4 routine.

The script then decompresses the binary using the LZNT1 algorithm before performing a process injection into explorer.exe, effectively hiding the malicious process under a trusted system host.

A unique sandbox-detection mechanism further complicates analysis: the script issues a ping to a randomly generated domain and exits if any response is received, indicating a monitored or emulated network environment.

After this unpacking and validation, the malicious payload gains persistence by modifying autorun registry keys or deploying scheduled tasks, depending on the operator’s configuration.

The combination of in-memory decryption, compression, and sandbox checks enables Asgard Protector to slip past endpoint defenses and execute without dropping a traditional executable on disk.

Infection Mechanism

Delving deeper into the infection mechanism reveals how Asgard Protector engineers its defense evasion.

The Nullsoft installer script leverages a simple yet effective obfuscation:-

findstr /b /r /c:"MZ" *.dat > offset.txt
for /f "tokens=1" %%A in (offset.txt) do set /A start=%%A
certutil -decode input.cab temp.exe
fsutil file createnew stub.bin %start%
more +%start% input.cab >> stub.bin

In this snippet, the script locates the “MZ” header within a CAB archive to determine where the PE header begins.

It then concatenates the extracted data past that offset to reconstruct the AutoIt binary. Once assembled, the script executes a companion AutoIt script that handles RC4 decryption and LZNT1 decompression before injecting the resulting payload into memory.

This piecemeal assembly and execution model allows the malware to evade signature-based antivirus engines and thwart disk-based inspection tools.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Researchers Reversed Asgard Malware Protector to Uncover it’s Antivirus Bypass Techniques appeared first on Cyber Security News.

The WARMCOOKIE backdoor first surfaced in mid-2024, delivered primarily via recruiting-themed phishing campaigns that coaxed victims into executing malicious documents.

Initially designed as a lightweight implant for remote command execution, its modular codebase enabled rapid adaptation to new objectives.

Over the past year, targets have included enterprise networks across multiple regions, with operators exploiting malvertising and spam campaigns to seed infections.

These intrusions have allowed threat actors to maintain persistent footholds, steal credentials, and deploy secondary payloads.

Elastic Security Labs analysts identified ongoing updates to WARMCOOKIE’s infrastructure and code family shortly after the initial disclosure.

By mid-2025, the backdoor was implicated in Europol’s Operation Endgame, yet infections persisted through revamped delivery mechanisms.

While earlier variants relied on hardcoded folder paths and static mutex names, recent builds leverage dynamic string banks and dual GUID-style mutexes for improved stealth.

Beyond simple command handlers, the malware now incorporates new capabilities to launch executables, DLLs, and PowerShell scripts on demand.

Each command type is routed through a unified function that writes the payload into a temporary directory before execution, either by invoking rundll32.exe for DLLs or PowerShell.exe for scripts.

This expansion broadens WARMCOOKIE’s utility as a flexible loader, accommodating custom modules without altering the core binary.

Infection Mechanism

WARMCOOKIE’s infection mechanism has evolved to evade static detection and complicate incident response.

Upon execution, the backdoor parses a configuration blob embedded within its resource section, decrypting fields such as the Remote Command and Control (C2) URL, RC4 key, and a campaign identifier.

The decryption routine resembles the following pseudocode:-

DWORD seed = GetTickCount();
srand(seed);
int index = rand() % STRING_BANK_SIZE;
char *path = string_bank[index];
desStringDecrypt(dword14001B620, buffer, bufferSize);

This snippet illustrates how WARMCOOKIE seeds its random number generator with the system uptime, selects a legitimate-looking folder name from a dynamic list, and decrypts campaign parameters at runtime.

The campaign ID field, introduced in later versions, enables operators to tag infections with distribution context—such as “traffic2”—facilitating granular tracking of victim sets.

After decryption, the malware establishes persistence by creating a scheduled task whose name and executable path mirror recognized software vendors drawn from the same string bank.

This shows a sample scheduled task entry where the task name and folder path reference a legitimate IT services company name.

By randomizing folder names and task identifiers, WARMCOOKIE avoids repeating known artifacts across samples, complicating signature-based detection.

In parallel, dual GUID-style mutexes regulate initialization sequences, ensuring only a single instance runs and mitigating race conditions during startup.

Collectively, these enhancements underscore the attackers’ emphasis on resilience and evasion, reinforcing WARMCOOKIE’s position as a persistent threat to enterprise environments.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Threat Actors Behind WARMCOOKIE Malware Added New Features to It’s Arsenal appeared first on Cyber Security News.