Full Report
Cybercriminals are now blending into legitimate systems. Huntress’ 2024 Cyber Threat Report reveals the latest unsettling trends and tactics we observed, including the misuse of remote monitoring tools and cloud storage services.
Analysis Summary
# Tool/Technique: Living off the Land via Remote Monitoring & Management (RMM) and Cloud Services
## Overview
This technique involves threat actors "hiding in plain sight" by weaponizing legitimate, off-the-shelf software and cloud infrastructure. Instead of deploying custom malware that might trigger signature-based alerts, attackers utilize trusted Remote Monitoring and Management (RMM) tools and established cloud storage providers to maintain persistence, move laterally, and exfiltrate data.
## Technical Details
- **Type:** Technique (Living off the Land / Tool Misuse)
- **Platform:** Windows, macOS, Cloud Environments (SaaS)
- **Capabilities:** Remote access, file synchronization, persistence, data exfiltration, and execution of administrative commands.
- **First Seen:** Historically ongoing; significant surge in RMM abuse and cloud storage misuse noted throughout 2023–2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services]
- [T1566 - Phishing]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1105 - Ingress Tool Transfer]
- **[TA0005 - Defense Evasion]**
- [T1564 - Hide Artifacts]
- [T1218 - System Binary Proxy Execution]
- **[TA0008 - Lateral Movement]**
- [T1210 - Exploitation of Remote Services]
- **[TA0010 - Exfiltration]**
- [T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage]
## Functionality
### Core Capabilities
- **Legitimate Access:** Using tools like ScreenConnect or Atera to bypass traditional endpoint security that trusts these binaries.
- **Data Staging:** Utilizing OneDrive, Google Drive, or Dropbox to host malicious payloads, making the download source appear as a trusted domain.
- **Persistence:** Installing RMM agents to ensure permanent remote access to a compromised host without needing to re-exploit vulnerabilities.
### Advanced Features
- **App Domain Manager Injection:** Tweaking .NET configuration files to run arbitrary code inside trusted applications, bypassing application whitelisting.
- **Stealthy Exfiltration:** Blending data theft with normal outbound cloud synchronization traffic to evade network anomaly detection.
## Indicators of Compromise
- **File Names:** `ScreenConnect.Client.exe`, `AteraAgent.exe`, `OneDrive.exe` (when found in non-standard directories or executed by unusual parent processes).
- **Network Indicators:**
- `*.screenconnect[.]com` (unauthorized instances)
- `*.atera[.]com`
- `1drv[.]ms` (misused for payload delivery)
- **Behavioral Indicators:**
- Sudden installation of RMM software on endpoints not managed by IT.
- Unexpected PowerShell or CMD execution spawned by cloud storage or RMM binaries.
- Large volumes of data being synced to personal/unauthorized OneDrive or Dropbox accounts.
## Associated Threat Actors
- Broad spectrum of cybercriminals, from ransomware affiliates to Initial Access Brokers (IABs).
- Actors specifically targeting Small to Medium-sized Businesses (SMBs) via managed service provider (MSP) infrastructure.
## Detection Methods
- **Behavioral Detection:** Monitor for "Living off the Land" binaries (Lolbins) making unusual network connections or spawning shells.
- **Configuration Monitoring:** Alert on the modification of `.config` files for .NET applications (protection against App Domain Manager Injection).
- **Audit Logs:** Review RMM logs for unauthorized sessions or new administrative accounts created outside of maintenance windows.
## Mitigation Strategies
- **Application Whitelisting/Control:** Implement strict policies to allow only approved RMM and remote access tools.
- **Identity Management:** Enforce Multi-Factor Authentication (MFA) on all RMM and Cloud Storage accounts to prevent unauthorized access.
- **Network Segmentation:** Restrict the ability of workstations to communicate with unauthorized RMM controller domains.
- **Hardening:** Disable or monitor the use of administrative shares and ensure service accounts for RMM tools follow the principle of least privilege.
## Related Tools/Techniques
- **ScreenConnect / Atera / AnyDesk:** Legitimate tools frequently abused for remote access.
- **OneDrive / Google Drive:** Used for "Dead Drop Resolvers" or data exfiltration.
- **App Domain Manager Injection:** A specific sub-technique for code execution within trusted environments.