Cybercriminals are increasingly integrating malware into business tools. They abuse trust features such as EV certificates. AI tools also contribute to the speed at which cybercriminals innovate their attacks and can deploy them even faster.
Furthermore, the research shows that:
- TrustConnect poses as legitimate IT support software but operates as a full-featured backdoor with remote desktop access, command execution, and file transfer.
- EV certificates are abused, with the operator receiving a legitimate Extended Validation certificate. This allows it to digitally sign malware, enabling it to bypass security checks before researchers can coordinate the revocation.
- The malware is delivered alongside or through legitimate tools such as ScreenConnect and LogMeIn. This reflects a significant overlap with the current cybercriminal infrastructure.
- After disrupting the infrastructure, the threat actor switches to a new infrastructure. Here, it begins testing a new version, the so-called DocConnect. This indicates a rapid adaptability.
- Based on artifacts from the ecosystem and operational overlap, researchers conclude that the threat actor was previously involved in Redline stealer activities.
Read also: HarfangLab warns of new AI-driven cyber risks
Disrupting MaaS activities gave cybercriminals the opportunity to fill gaps in the cybercrime market. And while these disruptions are effective and come with necessary costs, it appears that cybercriminals will always seek new ways to victimize. TrustConnect poses as legitimate RMM, but the bait, attack chains, and follow-up payloads (including RMMs) show similarities to techniques and delivery methods often observed in RMM abuse campaigns. This method is used by multiple threat actors. Additionally, it is highly likely that both the TrustConnect and DocConnect websites and agents are coded using AI agents. A new version will be significantly more advanced. Threat actors rapidly renew their methods thanks to AI, allowing them to maintain momentum. It is therefore even more important to respond to this.
For more information, read the full English report here.
Read also: Almost half (44%) of organizations prioritize cybersecurity in video investments
