Ransomware Gangs Weaponize AnyDesk, Splashtop, and Other Legitimate RATs to Bypass Security

Ransomware groups are increasingly turning to legitimate Remote Access Tools such as AnyDesk, UltraViewer, RustDesk, Splashtop and TightVNC to gain persistence, spread laterally, and evade defenses, according to Seqrite Threat Intelligence. The report highlights that a key enabler of these attacks is the exploitation of legitimate tools that are often whitelisted by organisations, making them attractive to adversaries seeking trusted access.

According to Seqrite, attackers may hijack an existing Remote Access Tool or perform a silent installation using signed installers with minimal footprint, enabling stealthy entry. The analysis also notes that attackers stop antivirus services and clear logs to hinder post-incident investigations, and that ransomware payloads can be delivered disguised as trusted updates with movement possible through credential reuse or enterprise-wide RAT deployments.

Seqrite links RAT abuse to several major ransomware families, for example AnyDesk has appeared in LockBit, Phobos, Dharma, MedusaLocker and Mallox campaigns, while Splashtop has been used in Makop, BlueSky and RansomHub operations.