The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns
Cofense Intelligence reports a growing trend of threat actors abusing legitimate remote access tools (RATs) — including GoTo RAT, ConnectWise RAT, SimpleHelp RAT, Datto RMM, and Heartbeat RM — in multi-stage attack chains delivered via phishing emails with embedded links. Rather than relying on a single tool, actors chain an initial RAT that beacons to a C2 server, which then directs the download of a second (sometimes third) RAT, often paired with legitimate uninstall-hiding utilities from sordum[.]org to evade detection and remediation. This modular approach supports Initial Access Broker (IAB) monetization models and complicates defender efforts to identify and remove all malicious components since each individual tool may appear legitimate in isolation.
- domainsordum[.]orgDomain hosting a utility abused by threat actors to hide installed RATs from the Windows uninstall list
Detection / HunterAnthropic
What Happened
Attackers are increasingly sending phishing emails with links that trick victims into downloading legitimate remote-support software (tools normally used by IT staff to control computers remotely), then using that first tool to secretly install a second remote-access program without the victim's knowledge. This affects any organization whose employees receive email, since these attacks got past well-known corporate spam filters and were only caught because trained employees reported the suspicious email. This matters because criminals are using this layered approach to firmly plant themselves inside computer networks and then sell that access to other criminals, and because each tool looks legitimate on its own, making it harder for security teams to spot and fully remove the infection. Organizations should train employees to recognize and report suspicious links, deploy behavior-based endpoint monitoring rather than relying only on known-bad file signatures, and maintain an approved list of remote access tools so any unapproved software stands out immediately.
Key Takeaways
- Threat actors are increasingly chaining legitimate remote access tools (RATs) such as GoTo RAT, ConnectWise RAT, Datto RMM, SimpleHelp RAT, and Heartbeat RM in multi-stage attacks rather than deploying a single RAT.
- Cofense observed a steady upward trend in multi-stage RAT usage from January 2025 to March 2026.
- These attacks are commonly linked to Initial Access Broker (IAB) activity, where the first-stage RAT establishes access that is then sold to another threat actor who deploys the second-stage payload.
- Attackers use a legitimate uninstall-hiding utility from sordum[.]org to conceal malicious software from the Windows uninstall list, hindering remediation.
- Phishing emails observed in these campaigns bypassed multiple secure email gateways including Mimecast, Microsoft ATP, Proofpoint, and Cisco IronPort, and were only caught via employee reporting.
Affected Systems
- Windows endpoints
- Enterprise email users
- Systems with ConnectWise RAT, GoTo RAT, SimpleHelp RAT, Datto RMM, or Heartbeat RM installed
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email with an embedded link (e.g., spoofed Adobe Cloud, title company, invitation, or DocuSign themes) is delivered to the victim, bypassing secure email gateways
- Delivery: Victim clicks the link and is redirected to a spoofed webpage that serves a first-stage legitimate RAT installer (e.g., GoTo RAT, Datto RMM, SimpleHelp RAT, or ConnectWise RAT)
- C2 Check-in: The installed first-stage RAT contacts a command-and-control server
- Secondary Payload Delivery: The C2 server directs the first-stage RAT to download and install a second RAT (commonly ConnectWise RAT) or additional tooling such as Heartbeat RM
- Defense Evasion: Threat actors may deploy an uninstall-list-hiding utility from sordum[.]org to conceal the malicious software from the victim and defenders
- Persistence and Monetization: Access is used directly or sold to another threat actor acting as an Initial Access Broker (IAB) for follow-on exploitation
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide YARA, Sigma, Snort/Suricata, KQL, SPL, or EQL detection content. It references Cofense's ThreatHQ Active Threat Report (ATR) platform for deeper campaign-specific details but does not include exportable detection logic in the blog post itself.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Legitimate RAT installers and their subsequent downloads generate observable process execution and network connections, but because the tools are legitimate and often used by IT staff, EDR alone may not flag them as malicious without behavioral context or allow-listing policies. |
| Network Visibility | Medium | C2 communications and secondary payload downloads occur over standard web protocols and often to legitimate cloud-hosted RAT infrastructure, making them difficult to distinguish from authorized remote support traffic without contextual analysis. |
| Detection Difficulty | Hard | Each individual RAT is a legitimate, digitally signed tool commonly used by IT and remote support staff, so static signature-based detection is largely ineffective; suspicion only arises when viewing the full delivery chain, unexpected installation context, or unapproved tool usage. |
Required Log Sources
- Email gateway/phishing detection logs
- Process creation logs (e.g., Windows Event ID 4688 / Sysmon Event ID 1)
- Network connection logs / proxy logs for outbound RAT installer downloads
- EDR process lineage and child-process telemetry
- DNS query logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for installation of a legitimate remote access/support tool immediately followed by the download and installation of a second, different remote access tool on the same host within a short time window. | EDR process creation and parent-child process chains, network connection logs | Persistence / Secondary Payload Delivery (T1219, T1105) | Low-to-Medium; legitimate IT support workflows occasionally chain tools, but this pattern is uncommon outside of managed service provider environments |
| Consider hunting for outbound connections to remote access tool cloud infrastructure or installer download URLs originating from a process that was itself recently installed via an email-delivered link. | Proxy/firewall logs correlated with email gateway logs and endpoint process creation timestamps | Initial Access / Command and Control (T1566.002, T1071.001) | Medium; requires correlation across log sources to avoid false positives from normal software installation |
| Consider hunting for execution of uninstall-list-hiding or artifact-concealment utilities, particularly those sourced from unfamiliar third-party utility sites, shortly after installation of a remote access tool. | EDR file creation/execution logs, download/browser history | Defense Evasion (T1564) | Low; legitimate business use of such uninstall-hiding utilities is uncommon |
| Consider auditing installed remote access/support software against an approved tool inventory to identify unauthorized RAT installations. | Software inventory/asset management data, EDR installed-application telemetry | Persistence (T1219) | Low; discrepancies against an approved list are a reliable indicator |
Control Gaps
- Signature-based antivirus/EDR alone will not flag legitimate, digitally signed RAT binaries as malicious
- Secure email gateways (Mimecast, Microsoft ATP, Proofpoint, Cisco IronPort were all reportedly bypassed in these campaigns) may not catch embedded-link phishing that leads to legitimate software downloads
- Standard uninstall-list review by IT staff may miss malicious RATs hidden via third-party concealment utilities
Key Behavioral Indicators
- A remote access/support tool installer executing as a child process of a browser or document viewer following a link click
- One remote access tool downloading and silently installing a second, different remote access tool without user interaction
- Installation of remote access software not present on an organization's approved tool list
- Use of PowerShell execution features embedded within a RAT's internal scripting capability rather than spawning a visible PowerShell process
- Presence of tools intended to hide software entries from the Windows Programs and Features / uninstall list
False Positive Assessment
Medium - The core techniques rely on legitimate, digitally signed remote access tools that are commonly and legitimately used by IT support staff, so behavioral detections must incorporate context (installation source, tool chaining, absence from approved lists) to avoid flagging authorized remote support activity.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting; if suspicious multi-stage RAT activity is identified, consider isolating the affected host if your EDR supports host isolation.
- Consider reviewing recent email gateway logs for messages themed around document notifications, e-signature services, or invitations containing embedded links, especially if they bypassed your secure email gateway.
- Consider auditing endpoints for unexpected installations of remote access/support tools such as ConnectWise, GoTo, SimpleHelp, Datto RMM, or Heartbeat RM that are not on an approved software list.
Infrastructure Hardening
- Consider maintaining and enforcing an approved list of remote access/support tools, and implement application allow-listing to block unauthorized RAT executables where feasible.
- Evaluate whether network egress filtering can restrict or log outbound connections to unapproved remote access tool infrastructure.
- Consider deploying behavioral-based EDR capable of detecting anomalous process chains (e.g., one remote tool spawning installation of another) rather than relying solely on static signatures.
User Protection
- Consider enabling detection/alerting on installation of remote access software outside of IT-managed deployment channels.
- If applicable, restrict local administrator privileges to reduce the ability of downloaded RAT installers to execute silently.
- Consider monitoring for use of uninstall-list-hiding or artifact-concealment utilities on endpoints.
Security Awareness
- Consider incorporating examples of document-notification, e-signature, and invitation-themed phishing lures into ongoing employee security awareness training.
- Reinforce and promote easy-to-use phishing reporting mechanisms for employees, as trained users were the primary detection method in the reviewed campaigns.
- Educate IT and helpdesk staff on the risk of legitimate remote access tools being leveraged as initial access vectors, and periodically review installed remote tools against the approved list.
MITRE ATT&CK Mapping
Initial Access
Execution
Command and Control
Additional IOCs
- Domains:
sordum[.]org- Domain hosting a utility abused by threat actors to hide installed RATs from the Windows uninstall list
