SEO Poisoning Attack Abuses Microsoft Binary To Deploy RMM Tools
ID: ac6ced32-fa57-50c2-a32b-9c6819de89e3
STIX ID: report--ac6ced32-fa57-50c2-a32b-9c6819de89e3
Feed Name: Cyber Press
Threat Score
A malicious SEO poisoning campaign impersonates the TestDisk download page to distribute a trojanized installer that uses DLL sideloading of a legitimate Microsoft binary to install ScreenConnect RMM. By abusing a trusted, signed executable and a legitimate remote-management tool, attackers gain persistent remote access and evade some security detections; organizations should verify download sources and monitor software installation behavior.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.