New Cyber Attack Exploits DeskSoft to Spread Malware via RDP Command Execution

A new cyber attack has been identified that weaponises a trojanised version of DeskSoft’s EarthTime application to deploy malware via Remote Desktop Protocol (RDP) command execution, enabling network reconnaissance and lateral movement. Security analysts attribute the intrusion to an affiliate operating across multiple ransomware‑as‑a‑service groups, and according to thethedfirreport[.]com the incident highlights a growing trend of supply-chain–style lures combined with living‑off‑the‑land techniques.

In September 2024, a user reportedly downloaded an EarthTime installer from a site masquerading as DeskSoft, and the binary, signed with a revoked certificate from Brave Pragmatic Network Technology Co., Ltd., dropped a chain leading to the SecTopRAT remote access trojan.

The attackers then staged SystemBC via WakeWordEngine.dll to establish a proxy tunnel for RDP connections, with the EarthTime payload mimicking the legitimate software, while later stages used Betruger, a backdoor masquerading as Avast, to harvest credentials and perform network discovery.

Exfiltration involved unencrypted FTP transfers to 144.202.61[.]209, and C2 communications were observed with 45.141.87[.]55 on ports 9000 and 15647; defenders are urged to strengthen application whitelisting and monitor for living‑off‑the‑land tool activity.