Ransomware Gangs Exploit Remote Access Tools to Stay Hidden and Maintain Control

Ransomware operators have evolved into multi-stage campaigns that exploit legitimate Remote Access Tools to stay hidden, maintain control, and systematically dismantle organisational defences. The piece highlights tools such as AnyDesk, UltraViewer, RustDesk and Splashtop, which are designed for IT administration but can be misconfigured or left unmanaged to provide backdoors, enable lateral movement and remote payload deployment.

It explains how attackers may hijack existing tools or silently install new ones using quiet installers, then establish persistence with registry run keys, hidden scheduled tasks and modified configuration files, sometimes escalating privileges to run tools with SYSTEM rights. Antivirus and logging may be neutralised or evaded as adversaries clear event logs, add tool directories to exclusions and use LOLBins like PowerShell, while continuing to operate within remote sessions to dodge suspicion.

The article also maps these activities to the MITRE ATT&CK framework and notes emerging trends such as AI-driven deployment and RaaS integrations, with a calendar date of 6 October 2025 used for context. According to Seqrite, legitimate remote tools remain a critical enabler for modern ransomware when mismanaged.