Crims create fake remote management vendor that actually sells a RAT

Proofpoint uncovered a RAT-as-a-service (TrustConnect) masquerading as legitimate RMM software that used a fake vendor website and a now-revoked EV code-signing certificate to sign malware, enabling it to bypass defenses; the RAT provides full remote control (screen recording/streaming, file transfer, command execution) and was distributed via phishing campaigns (e.g., MsTeams.exe → TrustConnectAgent.exe) with C2 infrastructure (178.128.69.245) that was briefly disrupted before operators pivoted to new infrastructure and a rebranded agent (DocConnect/SHIELD OS v1.0).