Know the tool.
Spot the misuse.

Overlord is a publicly available cross-platform remote access framework with Go-based agents and a TypeScript/Node/Bun server. Operators manage agents via a web panel or Electron client over encrypted WebSocket (WSS) C2. Windows agents commonly masquerade as svchost, persist under AppData\Roaming\Microsoft\DeviceSync and the user Startup folder, and write HKCU Run values named OverlordAgent-*. Observed campaigns have routed C2 through ngrok tunnels. Supports Windows, Linux, and macOS.

LinuxWindowsmacOS

N-able N-central is a remote monitoring and management (RMM) platform used by MSPs and IT teams. The platform supports remote commands, scripts, software deployment, file transfer and remote control. Its classic agents operate alongside the newer MSP Agent on Windows, Linux and macOS; optional Take Control components provide remote access. CISA added CVE-2026-86218, a static code injection flaw in the N-central server, to its Known Exploited Vulnerabilities catalog on 2026-09-08.

LinuxWindowsmacOS

Vicarius vRx is a commercial vulnerability remediation and patch management platform with agents for Windows, Linux and macOS. Its vScript engine remotely executes custom PowerShell, Bash and Batch scripts on managed assets. Huntress reported that in one INC Ransom intrusion, a scheduled task pointed to C:\Program Files\7-Zip\HealthUpdater.exe, a renamed vRx executable placed in an unusual folder.

LinuxWindowsmacOS

Beacon is an AGPL-3.0-licensed remote monitoring and management project from Synertek Cloud Services. It is unrelated to Cobalt Strike Beacon. Its reviewed source installs a Go agent as a Windows service, Linux systemd unit, or macOS LaunchDaemon and uses an operator-controlled Cloudflare Workers/D1/R2 backend. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use.

LinuxWindowsmacOS

Borealis is an AGPL-3.0-licensed, self-hosted remote management, monitoring, and automation platform with a Linux-hosted Engine and a Go endpoint agent. Its reviewed source implements remote shell, file, process, service, and software operations, with Windows and Linux agent support. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use.

LinuxWindows

CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use.

LinuxWindows

Endar is an open-source, self-hosted RMM platform focused on endpoint monitoring and compliance policies. Its controller source exposes agent registration, policy retrieval, compliance-result, and data-collection endpoints. Static extraction of the sole GitHub 1.0.0 release asset identifies a Linux x86-64 PyInstaller endpoint agent with registration, policy, data-collection, and compliance-task code. The source for that agent is not in the repository, and the asset does not establish a default installation directory or service; this entry records only supported release evidence.

Linux

Go Mini RMM is an open-source Go management server and endpoint agent. The agent sends heartbeats, connects to a controller WebSocket, executes remote commands, transfers files, lists and terminates processes, and checks for updates. The repository supplies a Linux systemd installer and a Windows scheduled-task installer. It is distinct from LOLRMM's existing Mini RMM entry, which documents a different .NET product.

LinuxWindows

Minexus is an open-source, self-hosted remote management system composed of a Nexus server, Console, and Minion endpoint agent. The agent supports inventory, remote shell, and file-management functions. No public malicious deployment was established in this source-focused review.

LinuxWindowsmacOS

NetMaster is an open-source Windows remote-management project with a self-hosted PHP panel and a Windows service client. Its source implements command execution, screen sharing, file transfer/download, and RDP actions. No public malicious deployment was established in this source-focused review.

Windows

Obliance is a self-hosted remote monitoring and management project with a Go endpoint agent. Its reviewed source provides Windows, Linux, and macOS installers and implements endpoint monitoring, remote shell, file, process, service, update, and remote-control functions. This entry records source-confirmed artifacts only; it does not establish a delivery relationship or malicious use.

LinuxWindowsmacOS

Opale is an open-source, self-hosted remote monitoring and management platform. Its documented deployment uses a controller hosted by the organization and a Go Windows agent that enrolls with that controller, reports inventory, executes dispatched scripts, and supports signed agent updates. The public repository contains Linux and macOS agent-service code and cross-platform release assets, but its current README says endpoint management is Windows-only; this entry therefore records Windows as the supported endpoint platform.

Windows

OpenUEM is an Apache-2.0-licensed endpoint-management platform with a self-hosted console and agent. The reviewed source and official deployment documentation support endpoint reporting, SFTP file browsing, package and settings management, and Windows VNC assistance. This entry records source- and vendor-documented host artifacts only. It does not establish a delivery relationship or malicious use.

LinuxWindowsmacOS

ProxiPort is an open-source, self-hosted remote management and reverse- tunnel project with a server and endpoint agent. It supports remote command execution, script execution, file transfer, system monitoring, and tunnels. It is a distinct continuation of RPort/OpenRPort; this entry does not assign RPort abuse reporting or RealVNC signing metadata to ProxiPort.

LinuxWindowsmacOS

Roster is an AGPL-3.0-licensed, self-hosted endpoint-inventory and remote management project. Its Go server distributes enrollment-specific agents; the reviewed deployment code installs Windows, Linux, and macOS agents with inventory, monitoring, remote-operation, and task capabilities. This entry records source-defined artifacts and does not establish a delivery relationship or malicious use.

LinuxWindowsmacOS

Sentinel RMM is an open-source, self-hosted management console and agent. Its Python agent reports inventory and health data, polls its configured controller for jobs, and can execute controller-dispatched jobs only when the controller enables remote execution. The project documents packaged Windows, macOS, and Linux agents for tagged releases, but this review found no published GitHub release at the reviewed commit.

LinuxWindowsmacOS

SparkRAT (Spark) is an open-source Go remote-access framework with a self-hosted controller that generates configured endpoint clients. It offers remote terminal, desktop, screenshot, file, and process functions. Public reporting has documented malicious SparkRAT deployments; that does not make every deployment of the upstream dual-use project malicious.

LinuxWindowsmacOS

LightRmmAgent is an unattributed custom Windows service described as RMM-style tooling by Threat Hunting Labs. In the reported RVTools SEO poisoning intrusion, an operator used Level to install MonitoringPanel.msi, which deployed LightRmmAgent. The service stored a machine identifier and contacted an Azure-hosted endpoint. No command execution through this agent was observed. It is distinct from RemoteAgentAgent and RMMCRAT; no legitimate vendor or official distribution source was established.

Windows

RemoteAgentAgent is malicious custom Windows remote-management tooling documented in an RVTools SEO poisoning intrusion by Threat Hunting Labs and MalBear Labs. Its PyInstaller-packaged Python service registers a device, polls for tasks, runs server-supplied PowerShell commands, and returns output and exit status. It was installed through RemoteAgent.msi and NSSM as a SYSTEM service. No independent legitimate vendor was established. This agent is separate from LightRmmAgent, RMMCRAT, and unrelated products named RemoteAgent.

Windows

RMMCRAT is the researchers' name, also written RMMcRAT, for a custom Windows C++ remote-access payload masquerading as an RMM agent. Threat Hunting Labs and MalBear Labs documented it as rmm.exe in an RVTools SEO poisoning intrusion. It registers hosts, reports system inventory, receives package tasks, and accepts a remote stop command. It is malicious custom tooling, not an established legitimate RMM product, and is distinct from LightRmmAgent and RemoteAgentAgent.

Windows

Allocentra is an endpoint remote monitoring and management (RMM) and PSA platform. Vendor documentation describes agents for Windows, Linux, and macOS that provide endpoint telemetry, patch management, remote commands, scripts, and MeshCentral-backed remote-control sessions.

LinuxWindowsmacOS

Basic RMM Agent is an unattributed Windows remote monitoring and management agent. Static analysis shows endpoint inventory, patch management, remote interactive desktop control, shell access, file transfer, and endpoint administration functions. The same binary also includes keylogging, vault scanning, webcam and audio functions, and hidden virtual desktop support. No independent vendor, official distribution source, or publisher signature was established; use the product identity, hash, and behavior rather than the generic agent.exe filename for triage.

Windows

BlackCrypt RMM Agent is a custom Windows endpoint-management agent whose compiled code implements registration, heartbeats, WebSocket job dispatch, interactive terminal sessions, remote command and script execution, inventory collection, and endpoint-management actions. The inspected sample self-identifies as a BlackCrypt Labs Inc product, but no independently verifiable publisher or product source was identified. Its signing certificate subject is C&P Global Investors LLC and local certificate validation reported that certificate as revoked. This entry documents the agent's confirmed functionality and observed host/network artifacts; it does not establish a legitimate commercial vendor, malware classification, or observed abuse.

Windows

GO RMM is a custom Windows management console that builds and controls remote agents. The inspected Go/Wails console includes agent enrollment and build controls, WebSocket command handling, remote desktop and input, shell, file, inventory, process, and session-management workflows. Its embedded interface also exposes high-risk modules such as webcam, microphone, and keylogging, as well as disruptive operations including a forced system crash. This entry records the console's statically demonstrated remote-administration functions; it does not establish a verified publisher, commercial vendor, malware classification, or observed abuse.

Windows

GxM RMM Agent is a custom Windows remote monitoring and management agent. Its inspected code implements enrollment, a Windows service, remote desktop support, shell and script execution, file operations, software and system inventory, patching, deployment, and endpoint administration. No independent vendor or source repository was identified, and the reviewed records contain no observed delivery-abuse relationship. This entry documents the agent's confirmed RMM functionality and static host artifacts; it does not establish a legitimate commercial vendor, malware classification, or a campaign.

Windows

IT Agent is a remote monitoring and management (RMM) platform. Its remote access capability is powered by Duet, while its separately named ITAgent RMM Sender components provide the broader IT Agent endpoint-management product. The IT Agent RMM Sender binaries are distinct from the Duet Display files covered by the existing Duet Display catalog entry.

LinuxWindowsmacOS

LS RMM is a legacy Windows remote monitoring and management product whose embedded components identify Logistical Software LTD. Static analysis of its management application and service worker shows Windows-service deployment, endpoint inventory, Windows Update inventory, scheduled screenshot capture and upload, update retrieval, and remote-request handling. This entry records the historical product artifacts and configured hosts; it does not establish current vendor operation, trusted distribution, or abusive use.

Windows

Mini RMM Agent is a custom Windows endpoint-management agent. Its inspected code self-installs as a Windows service, registers and sends heartbeats to a management server, polls for remote tasks, runs PowerShell, and supports software installation and testing workflows. The assembly identifies Senin Firman as its company, but no independently verified publisher or product source was identified. This entry documents statically confirmed RMM behavior and host artifacts only; it does not establish a legitimate commercial vendor, malware classification, or observed abuse.

Windows

Mremote is a commercial remote-support and endpoint-management product from EGSCI SARL (EGS Côte d'Ivoire). Its Windows agent provides remote screen and keyboard/mouse control, file transfer and management, clipboard synchronization, chat, remote shell and PowerShell execution, service and system actions, and consent-gated webcam and microphone access. An inspected configured agent was distributed under an Adobe-themed filename through a third-party download chain while retaining Mremote product metadata. The delivery context is suspicious but does not establish who deployed it or whether EGSCI authorized that distribution. Mremote is distinct from the unrelated mRemoteNG connection manager.

Windows

Nexus RMM is Scogo's endpoint-management product. Scogo describes its platform as providing direct device intelligence, endpoint telemetry, patching, vulnerability detection, compliance enforcement, and remote management. This entry records the vendor-associated Windows Nexus RMM Agent metadata reviewed in the census. The census establishes product identity only; it does not establish delivery, abuse, victim impact, or actor attribution.

Windows

OpenDesk RMM Agent is a remote monitoring and management agent from NextCore TI. Its first-party release repository documents Windows and Linux support; the reviewed Windows release is a signed OpenDesk RMM Agent binary.

LinuxWindows

RG System Suite is a commercial remote monitoring and management platform from Septeo IT Solutions, also known as RG Supervision. It provides endpoint monitoring, remote script execution, patch management, and remote-access workflows. An inspected Windows deployment-kit agent was distributed under the name Adobe_Helper.exe from a third-party download location while retaining RG Supervision product metadata and a valid RG System publisher signature. The filename is a masquerading lead, not proof of unauthorized access or of a particular actor. Vendor domains and normal installation artifacts identify the product and should be assessed against approved remote-management usage.

LinuxWindowsmacOS

UniSystem RMM is a Windows endpoint-management platform. Matching product-branded material describes a UniRMM agent with remote terminal access, RDP tunneling, remote script execution, and endpoint monitoring. This entry records matching UniRMM Windows sample metadata. The reviewed evidence establishes product identity and vendor-described capabilities only; it does not establish delivery, abuse, victim impact, or actor attribution.

Windows

Zecurit is a cloud-based endpoint management and remote monitoring and management platform for Windows, macOS, and Linux. It provides unattended remote access, file transfer, remote commands and scripts, software deployment, patch management, and hardware and software inventory. A Zoom-themed phishing delivery reported by @patialavii used zoominstaller.exe to deliver the Zecurit Windows agent. The reported payload contains Zecurit management and remote-access components; the lure filename is not a product-specific detection artifact. Investigate unexpected installations against the organization's approved remote-access tools.

LinuxWindowsmacOS

Lavawall is a commercial remote monitoring, management, and security platform developed by ThreeShield Information Security Corporation. It supports Windows, macOS, and Linux endpoints, with browser-based remote desktop control, background administration, remote shell access, file transfer, scripting, patch management, and device inventory. Windows deployments use LavawallWin.exe and a separate remote-support component. Signed Windows agent samples have been submitted under Zoom and Adobe installer names; those names alone do not establish malicious use and are not included as detection artifacts. An unexpected installation should be investigated in the context of the organization's approved remote-access tools.

LinuxWindowsmacOS

RMMmax is a remote monitoring and management platform that integrates with existing RMM products or manages devices through its standalone agents. It supports remote command and script execution, software deployment, patch management, and system monitoring across Windows, macOS, and Linux.

LinuxWindowsmacOS

OpsBridge Agent is the Windows endpoint component of OpsBridge LLC's remote monitoring and management platform at opsbridge.digital. The platform supports endpoint monitoring, remote command execution, file transfer, screenshots, process and software inventory, Windows event log collection, and software deployment. This entry covers the OpsBridge LLC product and is not related to OpenText Operations Bridge, which uses a similar name.

Windows

SetMe is a Techinline remote access and support platform for attended and unattended connections. It supports remote desktop control, file transfer, remote restart and reconnect, multi-monitor sessions, session recording, and centralized management of unattended devices. SetMe is a distinct, newer Techinline product alongside FixMe.IT and uses its own executables and service domains.

WindowsmacOS

BreezeRMM (Breeze) is an open-source remote monitoring and management platform developed by LanternOps, LLC. The vendor advertises remote access, fleet device management, patch management, script execution, software deployment, and monitoring across Windows, macOS, and Linux endpoints, with both self-hosted and managed cloud deployment options. Like other RMM agents, Breeze can be dropped and run by an operator to gain persistent remote access to endpoints. A Breeze agent sample is tracked on abuse.ch MalwareBazaar, and the on-disk artifacts below were reported in LOLRMM GitHub issue #235. A separately inspected unsigned Windows build identifies itself as PixoIT RMM Agent while retaining Breeze RMM Go module paths. Its product-specific filename is included as branded-build coverage; no PixoIT vendor affiliation or abuse of that build was established.

LinuxWindowsmacOS

ControlR is a legitimate Remote Monitoring and Management (RMM) tool developed by Bitbound. It has been abused by threat actors to establish persistent remote access to victim systems.

LinuxWindowsmacOS

Teleport Connect is Gravitational Teleport's desktop client. It provides authenticated access to SSH servers, databases, Kubernetes clusters, applications, MCP servers, and Windows desktops through a graphical interface.

LinuxWindowsmacOS

RemotePulse is a remote monitoring and management platform that advertises unattended remote access, terminal access, file transfer, chat, real-time monitoring, Windows patching, script automation, multi-tenancy, and silent agent deployment. Public abuse reporting observed RemotePulse agent installation under C:\Program Files (x86)\RemotePulseAgent with command-line execution pointing to remotepulse.io.

LinuxWindowsmacOS

Ninite Pro is a software deployment and patch management tool that silently installs and updates applications across endpoints. It is frequently integrated with RMM platforms and can be abused to silently download and install software, or deployed as the Ninite Agent to establish a remote software-deployment foothold on a host.

Windows

Remotely is an open-source remote control and remote scripting solution built with .NET, Blazor, and SignalR. It uses a self-hosted server plus endpoint agent and desktop clients for remote support, unattended access, remote terminal or scripting, chat, and file transfer. Public reporting has observed Remotely abuse for persistent access in intrusions.

LinuxWindowsmacOS

HelpWire is a remote support and remote access platform from Electronic Team, Inc. The public Quick Connect client supports attended remote desktop support, while the vendor documentation also describes unattended access for persistent operator reconnects, reboot/reconnect workflows, file transfer, chat, multi-screen viewing, Windows administrator rights, and automatic background updates.

LinuxWindowsmacOS

Dataplicity (by Wildfoundry) is a cloud-hosted remote-access service that exposes Linux systems — primarily Raspberry Pi devices — to the Dataplicity cloud for browser-based remote shell, "Wormhole" HTTP tunneling, and remote management. The agent installs via a curl|sudo python one-liner (`curl -s https://www.dataplicity.com/<TOKEN>.py | sudo python`) and registers the host with the operator's tenant under `*.dataplicity.com`. After install the operator has persistent remote shell access through the Dataplicity web console or Windows companion app without any inbound firewall change on the victim host. Catalogued by the LOTTunnels project under the "shell access" category for exactly this abuse profile.

LinuxWindowsmacOS

LocalXpose (loclx) is a free/subscription tunneling service from localxpose.io that exposes local TCP/UDP/HTTP services over the internet via the operator-controlled `*.localxpose.io` infrastructure. Marketed for developer use cases (webhook testing, local-server sharing), it is catalogued by the LOTTunnels project under the "shell access" category because the `loclx tunnel tcp/udp --port <PORT>` command pattern can expose an SSH or RDP listener through the operator's tenant subdomain, providing remote interactive access without a traditional RMM agent or open inbound firewall. Documented abuse cases include shell exposure for post-exploitation remote access, HTTP tunneling for data exfiltration, and tunnel-fronted phishing infrastructure.

LinuxWindowsmacOS

Nezha (nezhahq/nezha on GitHub) is a self-hosted, lightweight, open-source server and website monitoring / O&M tool written in Go. The architecture is a central Dashboard plus a per-host Agent that maintains a persistent gRPC connection back to the Dashboard for telemetry and remote operations. The Agent ships first-class capabilities by default — interactive WebSSH terminals, arbitrary command execution, file management, scheduled and triggered task execution, and batch operations across the entire fleet — and runs at SYSTEM on Windows or root on Linux/macOS/FreeBSD/OpenWRT/Synology without requiring privilege escalation. Threat actors have been observed abusing Nezha as a stealthy post-exploitation RAT. Huntress published "The Crown Prince, Nezha" (2025) documenting a China-nexus campaign that compromised 100+ hosts across Taiwan, Japan, South Korea, and Hong Kong via unauthenticated phpMyAdmin → log poisoning → AntSword web shell → Nezha agent deployment → Ghost RAT installation. Ontinue published a parallel writeup ("The Monitoring Tool That's Also a Perfect RAT") on the same abuse class. Kaspersky flags the official agent binary as `not-a-virus:HEUR:RemoteAdmin.Win64.NezhaAgent.gen`; Microsoft and most other AV engines do not currently flag it, which is exactly what makes it attractive as a living-off-the-land RMM masquerade.

AndroidFreeBSDLinuxOpenWRTSynologyWindowsmacOS

PiTunnel is a cloud-hosted remote-access service primarily aimed at Raspberry Pi devices (sister product of Dataplicity from Wildfoundry) that exposes local services and a persistent remote shell through the `*.pitunnel.com` tenant infrastructure. The agent installs via a curl|sudo bash one-liner (`curl -s https://pitunnel.com/get/<TOKEN> | sudo bash`) and supports persistent named tunnels via flags like `pitunnel --port=<PORT> --name=vnc --persist`. After install the operator can open arbitrary local TCP listeners (SSH, RDP, VNC, web) to the PiTunnel cloud for inbound interactive access without any firewall change on the victim host. Catalogued by the LOTTunnels project under the "shell access" category.

LinuxmacOS

ShellHub (cloud.shellhub.io / shellhub.io) is an open-source SSH gateway that enrolls devices via a per-tenant install script and gives operators browser-based remote terminal access through the ShellHub web dashboard. The agent installs via `curl -sSf "https://cloud.shellhub.io/install.sh?tenant_id=<TENANT_ID>" | sh` and registers the host into the operator's tenant; subsequent SSH connections are brokered through the ShellHub cloud over the persistent agent connection, with no inbound firewall change required on the device. Catalogued by the LOTTunnels project under the "shell access" category; documentation explicitly notes potential misuse by "insiders as well as threat actors" for "a variety of malicious tasks". Both a hosted SaaS (cloud.shellhub.io) and a self-hostable Docker deployment exist.

LinuxmacOS

Faronics Core is the legacy on-premises endpoint management platform from Faronics Corporation (Vancouver, BC, Canada). It uses a four-tier architecture - Core Console (admin UI), Core Server (logic), Core Database (workstation inventory), and Core Agent (endpoint). The Core Agent (FaronicsCoreAgent.exe / CoreAgentService.exe) installs as a SYSTEM service on managed workstations and brokers communication between the Core Console / Server and the workstation, allowing remote task execution, software inventory, and loadout of Faronics modules (Deep Freeze, Anti-Executable, Anti-Virus, Power Save, WINSelect). Although mostly superseded by Faronics Deploy / Faronics Cloud, the Core Agent is still seen on long-running enterprise / education fleets and is part of the Faronics product family per LOLRMM issue 151.

Windows

Faronics Deep Freeze is a "reboot-to-restore" endpoint protection and management product by Faronics Corporation (Vancouver, BC, Canada). Available as Standard, Enterprise, Cloud, and Mac editions. The Deep Freeze workstation agent (DFServ.exe / DFServEx.exe / DFWks.exe / DFC.exe) installs as a SYSTEM service and is managed either locally with a console password, via the on-prem Enterprise Configuration Administrator, or through Deep Freeze Cloud, where the cloud agent (CloudWksInstall.exe / Faronics Cloud Agent) runs alongside Deep Freeze and ties the endpoint to the Faronics Cloud / Deep Freeze Cloud console for remote freeze/thaw, software updater, anti-virus, anti-executable, MDM, and remote-control capabilities. Listed as a Faronics product family per LOLRMM issue 151.

WindowsmacOS

Faronics Deploy is a cloud-hosted Remote Monitoring and Management (RMM) platform by Faronics Corporation (Vancouver, BC, Canada). Provides software/OS deployment, patch management, application install/uninstall/update, hardware and software inventory, and integrated remote control over RDP, VNC, and a proprietary in-browser session ("Remote Pro"). The Windows endpoint agent (FaronicsDeployAgent / FWAService) installs as a SYSTEM service and communicates outbound only to AWS-hosted Faronics tenants in us-west-2 / eu-west-1, plus regional remotepro-* hosts for remote-control sessions. Faronics Deploy is the focus of LOLRMM issue 151. It has been observed in phishing campaigns delivering signed installers to enroll endpoints in attacker-controlled deployments for remote script execution.

WindowsmacOS

Faronics Insight is a classroom / lab management platform by Faronics Corporation (Vancouver, BC, Canada) that provides Teacher-to-Student remote control, screen monitoring, screen broadcasting, application and web blocking, keylogging, browser-history collection, and remote command execution across managed Student endpoints. The Insight Student agent (FIStudentAgent.exe / FIStudentSvc.exe / FIStudentUI.exe / STAHelper.exe) installs as a SYSTEM service on the managed device, while the Insight Teacher console drives the Students via an Insight Connector intermediary. While marketed for K-12 / EDU classroom management, the same Teacher → Student remote-control, monitoring, and command capabilities meet the LOLRMM RMM-shape definition and are part of the Faronics product family from issue 151.

AndroidChromeOSWindowsiOSmacOS

Freshservice is a SaaS IT Service Management (ITSM) platform from Freshworks Inc. that includes a built-in asset discovery and management capability via two endpoint agents distributed by Freshworks: the **Freshservice Discovery Agent** (FSAgent — installed per-endpoint, gathers hardware/software inventory and reports back to a tenant Freshservice URL) and the **Freshservice Discovery Probe** (a Windows scanning station that performs network-wide discovery via WMI/SSH/SNMP using bundled nmap, plink, Renci.SshNet and SNMP libraries). Both are MSI installers signed by "Freshworks Inc" (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) and downloaded from `fstools.freshservice.com/agent/` (Discovery Agent) or from the tenant Discovery Hub (Probe). The Discovery Agent registers a SYSTEM Windows service (`FSAgentService`), drops `FSAgentAutoUpdate.exe` (a Freshworks auto-updater that pulls new agent versions from `fstools.freshservice.com`), and persists tenant configuration (account URI + registration key + optional proxy credentials) under `HKLM\SOFTWARE\Freshdesk\FSAgent` (or `HKLM\SOFTWARE\WOW6432Node\Freshdesk\FSAgent` on x64). The Probe registers a SYSTEM Windows service (`FreshServiceScan`, image `Freshservice.DiscoveryProbe.ScanService.exe`), bundles a substantial network-scanning toolkit (nmap, plink/PuTTY, Renci.SshNet, SnmpSharpNet, Vim25Service, .NET TaskScheduler, SQLite), and stores its tenant config under `HKLM\SOFTWARE\Freshworks\FreshServiceProbe` including a JWT-style `RegistrationKey` value pointing at the tenant `*.freshservice.com` portal. Operationally relevant for defenders: the Discovery Agent provides a SYSTEM autostart service with auto-update from a vendor-controlled Freshworks domain on every Windows endpoint where it is deployed; the Probe ships and registers `plink.exe`, `nmap` and `nmap-service-probes`, full Vim25/VMware vSphere SDK bindings and a Renci SSH library — and is intended to perform credentialed sweeps of the entire network including SCCM (`Freshservice.Integrations.SCCM.dll`) and Active Directory (`ListADComputers.vbs`). Both components have been observed in incidents where a threat actor signs up for a Freshservice trial tenant and pushes the legitimately-signed Freshworks installer to victim hosts to gain a SYSTEM-level remote inventory/management foothold without tripping signature-based EDR. The cloud SaaS portion (`<tenant>.freshservice.com`, `myfreshworks.com`, `freshworksapi.com`, `freshconnect.io`) and the Freshworks "Switchboard"/Freddy AI features are pure browser-side and do not drop endpoint artifacts; only the Discovery Agent and Discovery Probe install local services.

LinuxWindowsmacOS

GLPI Agent is the open-source generic management agent maintained by the GLPI Project (Teclib'). It performs IT asset inventory, network discovery, network inventory (SNMP), VMware ESX inventory, software deployment, remote inventory and remote command/script collection on behalf of a GLPI server, communicating over HTTP/HTTPS. The agent is shipped as a Perl-based service / daemon for Windows, Linux and macOS, and is a fork of the FusionInventory agent. Network endpoints are tenant-configured: the agent talks to whatever GLPI server URL the operator specifies via the `server` parameter (or the MSI `SERVER` property). There is no centralised vendor cloud — every install can point at a different self-hosted (or Teclib-hosted GLPI Network) endpoint, which makes the agent attractive for both legitimate self-hosted IT shops and threat actors who stand up their own GLPI server for inventory/deploy abuse. The agent also embeds an HTTP daemon (default port 62354/tcp) for server-initiated triggers.

LinuxWindowsmacOS

InvGate is an Argentinian (Buenos Aires) IT operations vendor whose product family includes InvGate Service Management (formerly InvGate Service Desk) and InvGate Asset Management (formerly InvGate Insight, rebranded on 2024-10-07). InvGate Asset Management ships an endpoint Agent for Windows, Linux, macOS, and Android that performs hardware/software inventory, software metering, software deployment, vulnerability detection, and remote support — including a one-click "remote desktop connection from your inventory" feature. The Agent is distributed primarily as an MSI on Windows and is configured at install time with the tenant's Insight/IGAM URL plus an optional on-prem Proxy security token; agents in cloud tenants typically reach the platform via a per-tenant subdomain on invgate.net (load-balanced through lb-insight-001.invgate.net). The historic Windows agent installs under C:\Program Files (x86)\Inventec\InvGate.net Client\ (the "Inventec" folder name is a holdover from the original product line) and registers a SYSTEM service named InvClient. For remote agent push, InvGate's Remote-via-Proxy uses WMI/PsExec on Windows and SSH on Linux/macOS. Threat actors abusing legitimate RMM tooling for initial access, persistence, and remote command execution can stand up InvGate tenants and deliver the standard MSI agent — once installed, the agent runs as SYSTEM, persists as the InvClient service, beacons to the configured tenant URL every 8–12 hours, and exposes interactive remote desktop and software-deployment capabilities (MSI/EXE/.bat/.ps1 push) from the InvGate console.

AndroidLinuxWindowsmacOS

Monitic (monitic.com) is an EU/Turkey-based SaaS Remote Monitoring and Management (RMM) platform marketed at MSPs and IT departments. The product is operated by VAULT BİLİŞİM SİSTEMLERİ LTD.ŞTİ. (Turkish entity, Code Signing certificate via GlobalSign GCC R45 EV CodeSigning CA 2020) and exposes its tenant console at app.monitic.com with the agent control plane at api.monitic.com (both fronted by Cloudflare). The Windows agent ships as two SYSTEM services installed under C:\Program Files\Monitic\: a large (~50-60 MB) bundled `agent.exe` that embeds RustDesk dependencies (libvpx, WinPthreadGC) and the `kopia.io` backup engine for remote control, file transfer and backup, and a smaller (~6 MB) `amon.exe` watchdog/monitoring binary written in Go. A separate `MoniticInstaller.exe` bootstrapper (Themida-packed, signed by VAULT BİLİŞİM) is downloaded from app.monitic.com and uses `rundll32 url.dll,FileProtocolHandler https://app.monitic.com/installer` to drive the user through the install flow. An alternate silent installer is distributed as `agent_installer.bat` which downloads `installer.zip` from `https://api.monitic.com/api/ext/download-installer?t=<token>` via PowerShell `Net.WebClient.DownloadFile`, extracts it to `C:\Program Files\Monitic\`, fetches `conf.json` from `https://api.monitic.com/api/ext/get-config?t=<token>`, then registers both services with `agent.exe install` and `amon.exe install`. A WebRTC TURN server is operated at `turn.monitic.com` (77.37.120.252) for RustDesk peer-to-peer relay. Monitic agents are flagged by the ProofPoint Emerging Threats Open ruleset (`ET INFO Observed RMM Domain in DNS Lookup ( * .monitic .com)` and `ET INFO Observed RMM Domain in TLS SNI ( * .monitic .com)`) and are classified as a remote-access tool that may be abused under MITRE ATT&CK T1219 (Remote Access Software). Sandbox engines (Zenbox, CAPE) frequently mis-classify the Themida-packed Go/.NET binaries as `Snake` / `Gocoder`, but Microsoft / Symantec / Kaspersky engine results are clean and the binaries are EV-code-signed.

LinuxWindowsmacOS

Teramind is a US-based employee/user activity monitoring (UAM), insider-threat and DLP platform that ships with a tightly integrated remote monitoring and management agent for Windows and macOS. The endpoint agent is delivered in two flavours — a "Revealed" agent installed under C:\Program Files / C:\ProgramData\Teramind Agent that surfaces a tray UI, and a "Hidden" / "Stealth" agent installed under C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A} which is intentionally absent from Add/Remove Programs and renames its core processes (default rename: dwm.exe for the agent, clm.exe for the clipboard monitor). The Windows service is registered as tsvchst, with tmagentsvc.exe as the actual on-disk service binary. Cloud tenants reach the platform over TLS/WebSocket on tcp/443 to `<tenant>.teramind.co` plus rt.teramind.co and www.teramind.co; on-premise tenants additionally use TCP 10000 (proprietary TLS) and 10000-11000 to the App Server. The hidden agent and renamed binaries make Teramind attractive both as an authorised covert workplace surveillance tool and as a dual-use remote-access capability that threat actors and rogue insiders can plant for persistent monitoring, screen recording and remote command execution. The Teramind Inc. code-signing certificate (issued by DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1) signs every component, which trivially defeats publisher-based allow-listing if the certificate is permitted. Proofpoint Emerging Threats Open ships ET INFO rules covering the teramind.co domain in DNS Lookup and TLS SNI traffic, which is the easiest network-side telemetry to turn on for hunting unauthorised deployments. This catalogue entry distinguishes endpoint artifacts (services, on-disk paths, registry, control-plane traffic) from the cloud / SaaS-only features (e.g. AI behaviour analytics, compliance dashboards) which run server-side and produce no endpoint footprint of their own.

WindowsmacOS

TiFLUX (Tiflux) is a Brazilian SaaS Help Desk / Service Desk platform with an integrated remote monitoring and management (RMM) agent. The agent enables IT asset inventory, screenshot capture, in-tenant chat, command execution and remote access via a bundled UltraVNC stack (and an optional Splashtop integration) from a single web console at app.tiflux.com. The agent registers managed equipment with the tenant via agent.tiflux.com over HTTPS/WSS. Threat actors have been observed standing up TiFLUX tenants and abusing the platform's MSI distribution mechanism to deliver agent installers under decoy names (Adobe Reader, Zoom, DocuSign, etc.) hosted on per-tenant *.tiflux.com subdomains. Once installed, the agent gives remote command execution as SYSTEM, persistent SYSTEM service (TiService), and inbound remote control via the bundled UltraVNC server.

AndroidLinuxWindowsmacOS

TrustConnect (also marketed as TrustConnect Agent) is a commodity Remote Access Trojan distributed as Malware-as-a-Service that masquerades as a legitimate remote management and remote support agent. The operators sell access for approximately $300/month (Bitcoin/USDT) and ship branded installer variants that impersonate legitimate software (Adobe Reader, Microsoft Teams, Zoom, Google Meet, etc.) so victims download what looks like an installer but receive a fully featured RAT. Proofpoint observed TrustConnect delivered through email lures (bid invitations, tax notifications, document shares, government-themed messages) and used as a beachhead to deploy ScreenConnect, Level RMM, and hands-on-keyboard activity within minutes of installation. The operators registered the EV code-signing certificate "TrustConnect Software PTY LTD" through Certum (revoked 2026-02-06), and after disruption activity in February 2026 they pivoted to a successor named "DocConnect" / "SHIELD OS" hosted on networkservice[.]cyou.

Windows

VIZOR is an ITIL-aligned IT Asset Management (ITAM), Software Asset Management (SAM) and IT Service Management (ITSM) platform from Vector Networks (vector-networks.com / vizor.cloud). VIZOR offered both on-premise (IIS + Microsoft SQL Server) and cloud-hosted deployments and integrates with Microsoft SCCM/ConfigMgr, LanSweeper, SolarWinds and JAMF. Asset data can be collected agent-less or via the Vector Discovery Client — the discovery agent ships as part of the legacy Vector Asset Management Client (also branded LANutil32 Suite) which deploys 20+ Windows binaries (CLBOOT32.EXE, CLDIST32.EXE, CLDISTSVC.EXE, clMeter32.exe, clMeterSvc.exe, HTTPGet.exe, HTTPPush.exe, regapps.exe, WINCHK32.EXE, etc.) under a single MSI bundle. The Vector Discovery Client runs as a Windows service (DisplayName "Vector Asset Management Agent") under the LocalSystem account by default. It communicates with the Vector Discovery Server (a.k.a. Vector Asset Manager) over HTTP / HTTPS to an IIS endpoint — by default port 443 (HTTPS) or 80 (HTTP) but configurable to any port designated by the operator. Server-side, the "Vector Scheduler" Windows service parses the inventory upload and writes it to the on-premise SQL Server. Vector ships push-deployment tooling that uses the ADMIN$ share + local administrator credentials to install the Vector Client remotely from the VIZOR server, and the platform also supports executing standard MSIs, batch files or arbitrary scripts on managed endpoints via the bundled Software Distribution feature ("any valid code can be executed", per the Vector Asset Management v6.0 user manual). All of this gives an attacker who controls a VIZOR server (or who stands up their own Vector Asset Management server) a SYSTEM-level inventory + remote-execution channel against any reachable Windows host that has been pushed the agent. Network endpoints are tenant-configured: the agent talks to whatever Vector Discovery Server URL the operator specifies, not to a centralised vendor cloud — this is similar in shape to GLPI Agent and lets self-hosted VIZOR / VIZOR Cloud customers and threat actors alike point the agent at any reachable IIS host. VIZOR Cloud (vizor.cloud) is the vendor-hosted option and resolves to the same AWS infrastructure as vector-networks.com (18.204.85.68 in the historical resolutions VirusTotal observed).

Windows

Komari is a lightweight, self-hosted server monitoring tool with a web interface and lightweight agent. It supports server status monitoring through a web dashboard and collects telemetry through an installed agent.

FreeBSDLinuxWindowsmacOS

Lunixar is a Remote Monitoring and Management (RMM) platform by Lunixar SAS de CV (Mexico) for MSPs and IT teams. Provides remote access from the browser and a Windows app, script execution and scheduling, hardware/software inventory, process and service management, and real-time alerting. Has been observed abused in the wild, renamed as Googlemeet.msi and distributed via the phishing domain mymeetinggoogle.com, and as eDocument-*.msi for social engineering lures. Current Lunixar platform controls prevent operators from renaming generated agent installers from the console, reducing disguised installer deployment risk while preserving those historical filenames as abuse artifacts.

Windows

RemSupp is a remote desktop / remote support tool observed in a phone-based social engineering phishing attack. It installs in user context, creates RemSupp-specific artifacts under AppData, and communicates with api.remsupp.com.

Windows

Rodex RMM is marketed at https://www.rodex.cc/ as a self-hostable Remote Monitoring & Management platform — the operator pays in cryptocurrency ($150-$650/mo recurring, $250-$2,200 first-month onboarding) and the vendor's provisioner installs a stack (Node.js + MongoDB + Go relay + Nginx + SSL) onto the operator's own VPS. The agent is a single Go binary (`RodexAgent.exe`, ~7.3 MB) which establishes a WebSocket back to the operator's relay for remote desktop (WebRTC GUI streaming), remote terminal (PowerShell / Bash / Zsh), CPU/RAM/disk/network monitoring, Windows Update orchestration, and arbitrary script execution. The marketing positions Rodex as a privacy-preserving alternative to cloud RMMs ("every byte of data stays on your server"), comparable in shape to RustDesk / Tactical RMM / NetLock RMM. **However**, the project profile is materially different from those legitimate self-hostable peers and tracks closer to the TrustConnect / fake-RMM-as-a-service pattern: - No public source code (RustDesk, Tactical RMM, NetLock are open-source on GitHub; Rodex is not). - No corporate identity disclosed — no leadership names, no LinkedIn presence, the only contact is `support@rodex.cc`. - The `rodex.cc` domain was registered 2026-03-12 (NameSilo privacy WHOIS, Cloudflare-fronted). - Cryptocurrency-only payment. - Every `RodexAgent.exe` sample observed on VirusTotal is **unsigned** (no Authenticode publisher cert), despite the PE version block claiming `Rodex RMM Suite` / `© 2024-2025 Rodex Technologies Inc.` — that company name is not verifiable in any registry. - In-the-wild RodexAgent.exe samples have antivirus detection ratios ranging 27/76 to 48/76, with several engines applying the `trojan.tedy/misc` label (Tedy is a known stealer family); one sample carries the label `PasswordStealer.Spyware.Stealer.DDS`. - Agent filenames observed in the wild include both random-name `C:\Windows\<6-9-char>.exe` drops (e.g. `airj5.exe`, `ccwojfhc.exe`, `n0y9ytr.exe`) and decoy installers impersonating real organisations (`PROSEGURAgent.exe`, `FundacinAdsisAgent.exe`, `Daleph-Install-Default.exe`, `SifemInstall.exe`, `AdobepluginD3238-Install-Default.exe`, `AccessWinRAR.exe`, `InvitationCard.exe`) — all carrying the same `RodexAgent.exe` PE version-block strings underneath. Catalogued here as **Category: RAT** (same precedent as `trustconnect.yaml`) — not because the product is necessarily intended as malware, but because the in-the-wild distribution pattern is indistinguishable from RAT-as-a-service and defenders matching `RodexAgent.exe` will encounter unsigned binaries with malware-class filenames rather than vendor-signed RMM agents.

LinuxWindowsmacOS

Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.

WindowsmacOS

Net Monitor for Employees Professional is a commercial workforce monitoring tool developed by NetworkLookout. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including reverse shell connections, remote desktop control, file management, and the ability to customize service and process names during installation. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.

LinuxWindowsmacOS

iDrive is a cloud backup and remote management software that has recently been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security-related phishing lures, to establish unauthorized remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows Scheduled Task and has been used as an initial access mechanism and staging point for secondary RMM deployment.

AndroidLinuxWindowsiOSmacOS

Duet Display is a screen sharing and remote desktop software product that ships with RMM capability. The tool includes remote desktop access functionality and is part of the broader itagent product family which features system management and automation functions. Duet Display has been observed being used for remote access capabilities beyond its primary screen-sharing purpose.

AndroidWindowsiOSmacOS

FleetDeck is a remote monitoring and management (RMM) tool that provides agent-based remote desktop access and system management capabilities. The software supports remote desktop access, reboot/shutdown capabilities including safe mode, and virtual terminal support. FleetDeck agents report system information and enable remote access to managed endpoints. The tool can be deployed via MSI, MST, or shared link installations.

Windows

HeartbeatRM is a remote monitoring and management (RMM) tool that has been observed being leveraged in social engineering campaigns, including invitation-themed and Social Security–related phishing lures, to establish unauthorised remote access on victim endpoints prior to the deployment of ScreenConnect. The tool installs as a Windows service and serves as an initial access mechanism and staging point for secondary RMM deployment. Note - Specific binary names and paths reported in threat intelligence could not be independently verified via VirusTotal or official documentation.

Windows

HopToDesk is an open-source remote desktop tool similar to RustDesk. The tool has been observed being used by ransomware actors as a fallback when Quick Assist is blocked. HopToDesk creates firewall rules automatically and installs itself in Program Files. The tool communicates with signal servers and uses TURN servers for connectivity.

AndroidLinuxWindowsmacOS

ImmyBot is a remote monitoring and management (RMM) and automation tool designed for MSPs, focusing on workstation configuration, software deployment, and patch management. The tool has been reported in private threat intelligence as being delivered via phishing campaigns to establish unauthorized remote access, though no public references are currently available. ImmyBot uses signed agents and operates over secure websockets to managed endpoints.

Windows

ManageEngine ServiceDesk Plus is an IT service management (ITSM) and help desk software that includes remote control capabilities for IT support teams. The software provides comprehensive IT service management features including incident management, asset management, and remote desktop support.

LinuxWindows

Miradore is a mobile device management (MDM) and remote monitoring and management (RMM) tool founded in 2006 as a Finnish software company. In 2022, Miradore was acquired by GoTo and is now part of the LogMeIn portfolio of IT solutions. The tool is trusted by over 2,700 customers in more than 100 countries, managing over 900,000 devices globally. Miradore has been observed being used in cyber incidents, including phishing campaigns where the installer was renamed and delivered to establish unauthorized remote access.

AndroidLinuxWindowsiOSmacOS

NetBird is an open-source WireGuard-based VPN and remote access platform that provides secure peer-to-peer connectivity. It has been observed being abused in spear-phishing campaigns across Europe, Africa, Canada, the Middle East, and South Asia, targeting CFOs and other financial executives at banks, energy companies, insurers, and investment firms. In May 2025, Trellix documented a campaign that impersonated a Rothschild & Co recruiter, leading victims through a deceptive CAPTCHA to download a ZIP containing a malicious VBScript that silently installed NetBird and OpenSSH MSI packages, created a hidden local administrator account, enabled RDP, and persisted the NetBird agent via a scheduled task — granting attackers persistent peer-to-peer remote access. Hunt.io and Trellix link the infrastructure to APT MuddyWater (Earth Vetala) based on overlap with previously documented activity (IP 192.3.95.152 / Gophish on TCP 3333).

AndroidLinuxWindowsiOSmacOS

NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications. Recent versions include a "Remote Access" feature that enables remote support and assistance capabilities.

Windows

tmate is an open-source terminal sharing tool for Linux and Unix-like systems, built on tmux. It enables instant terminal sharing over SSH, allowing remote terminal access and collaboration. The tool creates a unique session that can be shared with others for remote access, making it a legitimate tool for system administration but also potentially useful for unauthorized remote access.

FreeBSDLinuxmacOS

Gorelo RMM is a remote monitoring and management tool facilitating remote access and control of devices for support and administration.

WindowsmacOS

GoTo Resolve (formerly LogMeIn Resolve) is an all-in-one IT management and remote monitoring and management (RMM) solution designed for small and midsize businesses (SMBs) and managed service providers (MSPs). It combines remote monitoring and management capabilities with remote support and access, ticketing, automation, and helpdesk functionality in a unified platform.

AndroidWindowsmacOS

PChelpware (also known as PCHelpWare) is a free and open-source remote support and remote desktop software developed by the UltraVNC team. Built on VNC technology and following the RFB protocol, PChelpware is designed specifically for remote technical support scenarios, virtual training, and helpdesk operations.

Windows

RdClient is a slim remote desktop client for the protocols RDP, VNC and Hyper-V. It manages remote desktops in a tree view similar to the Windows Explorer.

Windows

Remote Desktop Connection Manager (RDCMan) is a free Microsoft tool developed by Julian Burger for managing multiple remote desktop connections from a single interface. Part of the Sysinternals suite, RDCMan enables IT administrators, system administrators, server lab managers, developers, and testers to organize, group, and control numerous RDP sessions efficiently. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.

Windows

Remote Ripple is a free VNC viewer client developed by GlavSoft (the creators of TightVNC) for remote desktop access and control. It is a modern, lightweight viewer based on TightVNC technology that allows users to remotely access and control.

AndroidWindowsiOSmacOS

Veyon (Virtual Eye On Networks) is a free and open-source remote monitoring and classroom management software designed for educational environments and remote support scenarios. It enables monitoring and controlling computers across multiple platforms, allowing administrators and teachers to view and control computer labs, interact with students, and provide remote technical support.

LinuxWindows

baramundi Management Suite is a comprehensive Unified Endpoint Management (UEM) platform designed for automated endpoint management across Windows, macOS, iOS, Linux, and Android devices. It provides features for inventory and network discovery, endpoint security, patch management, mobile device management (MDM), IT automation, operating system deployment and configuration, remote access service, digital employee experience (DEX), and license management. The baramundi Management Agent (bma.exe) operates as a Windows service named BARAAGNT and is used for remote monitoring and management of enterprise systems. The suite is available for on-premises, hybrid, or fully hosted deployment. baramundi also offers the Proactive Hub, a cloud-based platform for proactive IT management.

AndroidLinuxWindowsiOSmacOS

Acronis Cyber Protect (Remotix) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

NetLock RMM is an open source Remote Management and Monitoring tool with a paid support and cloud offering.

LinuxWindowsmacOS

Devolutions Remote Desktop Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AndroidLinuxWindowsiOSmacOS

Aspia is an open-source Remote Desktop, file transfer and system information tool.

LinuxWindowsmacOS

Parsec is a remote desktop streaming tool for remote access and monitoring, mainly used for gaming and collaboration. Remote desktop reimagined – a seamless 4k experience at up to 60 frames per second with near-zero latency. Secure, flexible, effortless access to whatever you do, at any time, from wherever you go. Parsec focuses on real-time graphical interaction rather than system administration but can still be abused for lateral movement and initial access.

AndroidLinuxWindowsmacOS

Bluetrait is a Remote Monitoring and Management (RMM) tool designed to provide IT administrators and Managed Service Providers (MSPs) with remote access, system monitoring, and automation capabilities across Windows, Linux, and macOS devices. Like many RMM solutions, Bluetrait enables seamless remote management, allowing administrators to execute commands, install software, and troubleshoot issues without direct user intervention. However, Proofpoint's research has highlighted how threat actors are increasingly abusing RMM tools, including Bluetrait, for malicious purposes. Attackers leverage Bluetrait as part of their post-exploitation strategy, often deploying it through phishing or social engineering techniques. Once installed, Bluetrait allows attackers to establish persistent remote access, circumvent traditional security controls, and execute malicious payloads under the guise of legitimate administrative activity.

LinuxWindowsmacOS

SimpleHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.

FreeBSDLinuxWindowsmacOS

Alpemix is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AndroidLinuxWindowsiOSmacOS

GoToMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Kaseya (VSA) aka Unigma is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed.

Windows

AnyViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Atera is a remote monitoring and management (RMM) tool. It is used by threat actors to deploy ransomware or facilitate command execution and lateral movement.

LinuxWindowsmacOS

247ithelp.com (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Absolute (Computrace) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Access Remote PC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AndroidLinuxWindowsiOSmacOS

Addigy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Adobe Connect is Adobe's virtual meeting, webinar, and training platform. Its desktop application supports Windows and macOS and can be used for screen sharing and remote collaboration. The application communicates with Adobe Connect service domains over HTTPS and WebRTC.

WindowsmacOS

AeroAdmin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AliWangWang-remote-control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Any Support is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Anyplace Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Apple Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Auvik is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Barracuda is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Basecamp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

BeamYourScreen is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

BeAnyWhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

BeInSync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

BeyondTrust is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

BeyondTrust (Bomgar) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Bitvise SSH Client is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Bitvise SSH Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

CentraStage (Now Datto) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Centurion is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Chicken (of the VNC) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Chrome Remote Desktop is Google's cross-platform remote access and support service for Windows, macOS, and Linux hosts. It supports persistent remote access and one-time attended support sessions through a web client. IMPORTANT: This tool is signed with legitimate Google LLC certificates that are also used to sign Chrome and other Google applications. Do not blindly block these certificate thumbprints. Use the certificate data for detection, hunting, and analysis with product-specific context.

LinuxWindowsmacOS

Chrome SSH Extension is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Cloudflare Tunnel (cloudflared) creates outbound-only tunnels from a host to Cloudflare, exposing internal services (RDP, SSH, SMB, HTTP) without inbound firewall rules. In the Swisscom intrusion described by The DFIR Report in June 2026, threat actors installed it as a Windows service on a domain controller for persistence and proxied RDP through it.

LinuxWindowsmacOS

Comodo RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

ConnectWise is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Connectwise Automate (LabTech) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ConnectWise Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

CrossLoop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

CrossTec Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available. **IMPORTANT**: Some components of this tool may be signed with legitimate Microsoft Windows Component Publisher certificates that are used to sign Windows system components. Do NOT blindly block Microsoft certificate thumbprints as doing so will break Windows functionality in your environment. Use certificate data for detection, hunting, and analysis purposes only.

CruzControl is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

DameWare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

DeskDay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

DeskNets is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

DeskShare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

DesktopNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Dev Tunnels (aka Visual Studio Dev Tunnel) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Distant Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Domotz is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

DragonDisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Duplicati is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

DW Service is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Echoware is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

eHorus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LinuxWindowsmacOS

Electric AI (Kaseya) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

EMCO Remote Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Encapto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Ericom AccessNow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Ericom Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ESET Remote Administrator is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ExtraPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

ezHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

FastViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

FixMe.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Fortra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Free Ping Tool is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Free Tools Launcher is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

FreeNX is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

FreeRDP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

GatherPlace-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

GetScreen is a remote monitoring and management (RMM) tool that enables remote desktop access and unattended persistent access via service installation. It can be installed via command line and registers itself as a Windows service named "Getscreen.me".

Windows

GoTo Opener is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

GoToAssist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

GoToAssist Agent Desktop Console is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

GotoHTTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Goverlan is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Guacamole is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

HelpBeam is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

HelpU is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

I'm InTouch is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Impero Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Instant Housecall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Insync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

IntelliAdmin Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Iperius Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ISL Light is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

ISL Online is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Itarian is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

ITSupport247 (ConnectWise) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Ivanti Remote Control is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

JollysFastVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Jump Cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Jump Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Kabuto is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

KHelpDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

KickIdler is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

KiTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Koofr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LabTeach (Connectwise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

LabTech RMM (Now ConnectWise Automate) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LANDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Laplink Everywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Laplink Gold is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Level.io is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Lite Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LiteManager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LogMeIn rescue is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Manage Engine (Desktop Central) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ManageEngine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ManageEngine RMM Central is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MEGAsync is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Microsoft Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Mikogo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MioNet (Also known as WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MioNet (WD Anywhere Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MobaXterm is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Mocha VNC Lite is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

mRemoteNG is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MSP360 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

mstsc.exe is the built-in Microsoft Remote Desktop Connection (RDC) client that ships with all supported Windows versions. The "MSTSC" name is a historical acronym for "Microsoft Terminal Services Client" — the product was renamed from Terminal Services to Remote Desktop Services, but the binary kept the original name. It is signed by Microsoft and located in %SystemRoot%\System32\mstsc.exe. Adversaries abuse the native RDP client for interactive lateral movement (T1021.001) and as a living-off-the-land remote-access pathway because it is present, signed, and frequently allow-listed in enterprise environments. This entry consolidates the previous duplicate entries "Microsoft RDP" and "Microsoft TSC", which described the same binary under different names. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.

Windows

MultCloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MyGreenPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

MyIVO is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

N-Able Advanced Monitoring Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

N-ABLE Remote Access Software is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Naverisk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Netop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Netop Remote Control (aka Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Netop Remote Control (Impero Connect) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Netreo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NetSupport Manager is a remote monitoring and management (RMM) tool. Its remcmdstub.exe component is the NetSupport Remote Command Prompt Stub.

Neturo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Netviewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Netviewer (GoToMeet) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NinjaOne (formerly NinjaRMM) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NinjaRMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NoMachine is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NordLocker is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NoteOn-desktop sharing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

NTR Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

OCS inventory is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Onionshare is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

OptiTune is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pandora RC (eHorus) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Panorama9 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Parallels Access is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

pcAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pcnow is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pcvisit is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

PDQ Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pilixo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pocket Cloud (Wyse) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pocket Controller is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Pocket Controller (Soti Xsight) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

PSEXEC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

PSEXEC (Clone) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Pulseway is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

PuTTY Tray is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

QQ IM-remote assistance is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Quest KACE Agent (formerly Dell KACE) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Quick Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Rapid7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

rdp2tcp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

RDPView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

rdpwrap is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RealVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remcos is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remmina is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remmon is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remobo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remote Desktop Manager (Devolutions) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remote Desktop Plus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remote Manipulator System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remote Utilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Remote.it is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

RemoteCall is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

RemotePass is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

RemotePC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

RemoteUtilities is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RemoteView is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RES Automation Manager is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Rocket Remote Desktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Royal Apps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Royal Server is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Royal TS is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RPort is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RuDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RunSmart is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

RustDesk is an open-source remote desktop and remote access tool that can use the public RustDesk rendezvous/relay servers or a self-hosted server. Threat actors install it as a Windows service for persistent, interactive re-entry; in a 2025 Bumblebee to Akira intrusion it was installed on multiple servers, run in tray mode, and later used to return to the environment and pivot via RDP before ransomware deployment.

LinuxWindowsmacOS

S3 Browser is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ScreenMeet is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SecureCRT is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Seetrol is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Senso.cloud is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ServerEye is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ShowMyPC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SimpleHelp is a remote monitoring and management (RMM) tool. It has been observed being abused by threat actors as a persistence and remote-access vector during ransomware operations, including campaigns delivering the "Crazy" ransomware (VoidCrypt family) reported by Huntress in February 2026.

Windows

Site24x7 is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SkyFex is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SmartCode Web VNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SmartFTP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SmarTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Solar-PuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Sophos-Remote Management System is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Sorillus is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Splashtop (Beta) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Splashtop Remote is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SpyAnywhere is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SunLogin is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SuperOps is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SuperPuTTY is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Supremo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

LinuxWindowsmacOS

Syncro is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Syncthing is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Synergy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

SysAid is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Syspectr is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Tactical RMM is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Tailscale is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Tanium is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Tanium Deploy is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

TeamViewer is a remote monitoring and management (RMM) tool.

AndroidChromeOSLinuxWindowsiOSmacOS

TeleDesktop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Terminals is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

TigerVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

TightVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ToDesk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Total Software Deployment is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

TurboMeeting is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Ultra VNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

UltraViewer is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

UltraVNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Visual Studio Dev Tunnel is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

VNC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

VNC Connect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

WebEx (Remote Access) is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

WebRDP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Weezo is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

WinSCP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

X2Go is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Xeox is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

Xpra is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

XRDP is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Xshell is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Yandex.Disk is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Zabbix Agent is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ZeroTier is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

ZOC is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Zoho Assist is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

Windows

ngrok is a tunneling / reverse-proxy service frequently abused for remote access and C2 concealment. More operational detail is tracked in LOTTunnels. ANY.RUN documented Overlord RAT routing encrypted WSS C2 through an ngrok tunnel (hostname pattern *.ngrok... to 3.124.142.205:443) in its October 2026 Overlord write-up.

Ammyy Admin is a remote monitoring and management (RMM) tool. Ammyy admin has been used by scammers to gain remote access to victims' computers. The tool is legitimate and is used by IT professionals for remote management. However, it has been abused by scammers to gain unauthorized access to victims' computers. The tool is free for personal use, but a license is required for commercial use. The tool allows for remote desktop control, file transfer, voice chat, and more. The tool is available for Windows only. will be added as it becomes available.

Windows

Level is a remote monitoring and management (RMM) tool. Threat Hunting Labs documented its malicious installation through an RVTools-themed SEO poisoning chain in 2026. An operator used Level to run discovery commands as SYSTEM and install the separate LightRmmAgent service. The report distinguishes Level's routine inventory from operator activity.

Windows

ScreenConnect is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.

AndroidLinuxWindowsiOSmacOS

AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. It was developed with the primary goal of facilitating remote work, technical support, and collaboration between individuals and teams.

AndroidChromeOSLinuxWindowsiOSmacOS

Mouse Without Borders is a Microsoft Garage utility that lets you control up to four Windows computers with a single keyboard and mouse, with clipboard sharing and simple drag-and-drop file transfers. **IMPORTANT**: This tool is signed with legitimate Microsoft Corporation certificates that are also used to sign numerous other Microsoft products and Windows components. Do NOT blindly block these certificate thumbprints as doing so will likely break essential Windows functionality and other Microsoft applications in your environment. Use certificate data for detection, hunting, and analysis purposes only.

Windows