• The United States is the primary target, representing nearly half of the campaign's activity.
• The campaign leverages tax-related documents to trick users into initiating malicious installations.
• The threat actors abuse legitimate RMM tools to gain remote access to compromised systems.

According to ANY.RUN's analysis, researchers connected 601 distinct cases to this broader global operation. The technique relies on social engineering to convince victims that they are installing necessary software, when in reality they are granting the attackers remote control capabilities. This method allows the threat actors to bypass traditional security measures by using trusted administrative tools for malicious purposes.

The shift in geographic focus highlights the adaptability of the threat actors, who adjusted their lures to match the target audience. While tax season remains a common vector, the success of this campaign depends on the inherent trust users place in branded documents and familiar software names.

Source: The Hacker News

Given that the U.S. is now the primary target, has your organization restricted or audited the use of RMM tools to prevent this type of abuse?