Cofense Intelligence reports a growing trend of threat actors abusing legitimate remote access tools (RATs) — including GoTo RAT, ConnectWise RAT, SimpleHelp RAT, Datto RMM, and Heartbeat RM — in multi-stage attack chains delivered via phishing emails with embedded links. Rather than relying on a single tool, actors chain an initial RAT that beacons to a C2 server, which then directs the download of a second (sometimes third) RAT, often paired with legitimate uninstall-hiding utilities from sordum[.]org to evade detection and remediation. This modular approach supports Initial Access Broker (IAB) monetization models and complicates defender efforts to identify and remove all malicious components since each individual tool may appear legitimate in isolation.
RAT Abuse
1 post
The Evolution of Remote Access Tool Abuse: From Single Payloads to Multi-Stage Campaigns