Action1

2023年4月18日

(在新标签页打开)(图片来源:Pixabay)另一个合法的企业软件平台正在被各种网络犯罪将恶意软件和ransomware部署到毫无戒心的受害者。网络安全研究人员DFIR报告发现多个威胁使用Action1 RMM演员,一个良性的远程桌面监视和管理解决方案。就像任何其他远程管理工具,Action1使用托管服务提供商(议员)和其他IT团队管理端点(在新标签页打开)在网络从远程位置。他们可以用它来处理软件补丁、软件安装,故障排除,以及类似的。BleepingComputer报告暗示,特别是犯罪分子盯上了这软件,由于它提供的丰富功能的免费版本。即100端点可以在免费的服务计划,免费版的唯一的限制,这将使它成为一个有趣的罪犯的工具。孔蒂抬头多个身份不明的团队被发现使用Action1活动,但是一个特别的突出,蒙蒂。这一组是由网络安全研究人员首次发现去年夏天从黑莓事件反应小组,后来发现,蒙蒂有着臭名昭著的很多特性,孔蒂辛迪加。孔蒂的攻击通常是通过AnyDesk进行,或Atera,而不是Action1。袭击者还观察到使用Zoho ManageEngine桌面中央。 In any scenario, the attackers would use remote monitoring and management tools to install all kinds of malware on victim endpoints, and in some cases - even ransomware. Read more Sometimes, the attackers would send an email, impersonating a major brand, and demanding the victim urgently gets in touch in order to stop a large transaction or receives a huge refund. After getting in touch with the victim, they would demand they install RMM software and then use it to compromise the target systems. The company is aware that its software is being abused for nefarious purposes and is trying to help, although there’s not much it can really do: “Last year we rolled-out a threat actor filtering system that scans user activity for suspicious patterns of behavior, automatically suspends potentially malicious accounts, and alerts Action1’s dedicated security team to investigate the issue,” Mike Walters, VP of Vulnerability and Threat Research and co-founder of Action1 Corporation, told BleepingComputer. Via: BleepingComputer (opens in new tab) Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions (opens in new tab) and Privacy Policy (opens in new tab) and are aged 16 or over.