RMM
Controlio
Controlio is a commercial workforce monitoring tool developed by EfficientLab. Marketed for employee productivity tracking, the software provides capabilities that extend well beyond passive screen monitoring, including keylogging features, screen recording, clippboard logging, and email and web search monitoring. These features, while designed for legitimate administrative use, make it an attractive tool for threat actors seeking to blend into enterprise environments without deploying traditional malware.
Tool overview
- Category
- RMM
- Research authors
- CERT Cwatch Almond
- Created
- 2026-03-20
- Last modified
- 2026-03-20
- Privileges
- user
- Free / availability
- Yes
- Verification required
- No
- Supported platforms
Windows
macOS
Capabilities
Executables & installation paths
- Filename
- wesvc.exe
- OriginalFileName
- Not recorded
- Description
- uploads the recorded data & logs.
- Product
- Controlio
Installation paths
C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\
weCliboardListener.exe
bbl.exe
weprtct.exe
wemonc.exe
wesvc.exe
libeay32.dll
ssleay32.dll
wec_launcher_[a-Z0-9]*_.exe
wec_launcher_[a-Z0-9]*_.pkg
weInstSvc.exe
FORENSIC EVIDENCE
Disk artifacts
- File
- weClipboardListener.exe
- Description
- Controlio binary
- OS
- Windows
- File
- bbl.exe
- Description
- Controlio binary
- OS
- Windows
- File
- weprtct.exe
- Description
- Controlio binary
- OS
- Windows
- File
- wemonc.exe
- Description
- Controlio binary
- OS
- Windows
- File
- wesvc.exe
- Description
- Controlio binary
- OS
- Windows
- File
- libeay32.dll
- Description
- Controlio binary
- OS
- Windows
- File
- ssleay32.dll
- Description
- Controlio binary
- OS
- Windows
- File
- wec_launcher_[a-Z0-9]*_.exe
- Description
- Controlio windows installer
- OS
- Windows
- Example
- MD5: 2e6f6b62b16904eee7b2de51951f22a8
- SHA1: 49dcf901491e60079289732c7291a38f18ed4918
- SHA256: 4ad77ebb2fa42dacd375061ec86ea35bb2d003ce057b764a0faff948d8063cc5
- File
- wec_launcher_[a-Z0-9]*_.pkg
- Description
- Controlio macos installer
- OS
- Mac
- Example
- MD5: df66eb79c15937bfe2cdf8774901778e
- SHA1: a1f765235010343dd9b25c50de7f6b04e4dd01b5
- SHA256: 1591df6f0575fa903481b31122f8be5a2ead8ff75800c57e6324c9ccc1969e0f
- File
- weInstSvc.exe
- Description
- Controlio binary
- OS
- Windows
- Example
- MD5: b290abc61e20d8de07f009348c2c3e2f
- SHA1: 3b0412a27fc2f9277c0fb484d3ff7382b0da6e32
- SHA256: 2cae3bfd61025f45810c787cfad9b6287882494fa9317ec6725ac65390be254a
- File
- C:\ProgramData\{E0E95C6C-F194-4846-928D-E5538022226D}\
- Description
- Controlio binary
- OS
- Windows
FORENSIC EVIDENCE
Other artifacts
- Type
- Service
- Value
- weSvcService
References
- https://controlio.net
- https://www.knowyouradversary.ru/2026/01/366-adversaries-started-to-abuse.html
- https://kb.controlio.net/hc/en-us/articles/360019139977-Which-paths-files-need-to-be-whitelisted-to-avoid-issues-with-the-work-of-Controlio
- https://kb.controlio.net/hc/en-us/articles/360019262918-Which-processes-in-the-task-manager-belong-to-Contorlio-s-Client