Full Report
We dug into a recent malspam campaign that involved an installer for a commercially sold remote monitoring and management (RMM) tool called Tiflux.
Analysis Summary
# Tool/Technique: Tiflux (Rogue RMM Deployment)
## Overview
Tiflux is a legitimate commercial Remote Monitoring and Management (RMM) software originating from Brazil. Recently, threat actors have weaponized it as a "Rogue RMM" to establish persistent, stealthy access to victim environments. By abusing the legitimate nature of the tool, attackers can bypass traditional security perimeters that might otherwise flag custom malware, using it to profile systems, execute commands, and exfiltrate data.
## Technical Details
- **Type:** Tool (Commercial RMM abused for malicious purposes)
- **Platform:** Windows
- **Capabilities:** Persistence, system profiling, remote command execution, screenshot transmission, and file deployment.
- **First Seen:** Increased activity observed starting February 27, 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0003 - Persistence]**
- [T1133 - External Remote Services]
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation] (via vulnerable `HwRwDrv.sys` driver)
- **[TA0005 - Defense Evasion]**
- [T1218.007 - System Binary Proxy Execution: Msiexec]
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1113 - Screen Capture]
- **[TA0002 - Execution]**
- [T1059 - Command and Scripting Interpreter]
## Functionality
### Core Capabilities
- **Remote Access:** Provides a direct interface for attackers to interact with the victim's desktop.
- **Persistence:** Once installed via MSI, the RMM service ensures the attacker maintains access across reboots.
- **System Profiling:** Automatically collects host information to assist attackers in identifying high-value targets.
### Advanced Features
- **Daisy-Chaining RMMs:** Attackers use the initial Tiflux access to sideload or install additional RMMs (Splashtop, ScreenConnect, UltraVNC) to ensure redundancy if one tool is detected.
- **Vulnerable Driver Deployment:** The installer includes `HwRwDrv.sys`, an outdated kernel driver signed with expired certificates, which can be exploited to achieve SYSTEM-level privileges.
- **Screen Capture:** Periodic transmission of screenshots to the C2 to monitor user activity.
## Indicators of Compromise
- **File Names:** `Network Solutions Agreement.msi`, `HwRwDrv.sys`
- **Network Indicators:**
- `lenwillfilenetwork[.]com` (Download/Landing page)
- `businessservices@hg[.]lawdepotisland[.]com` (Sender address)
- `tiflux[.]com` (Legitimate domain, but traffic may be unauthorized)
- **Behavioral Indicators:**
- Execution of `msiexec.exe` to install unauthorized RMM software.
- Multiple RMM agents (e.g., Tiflux and Splashtop) running simultaneously on a single workstation.
- Deployment of kernel drivers with expired digital signatures.
## Associated Threat Actors
- Unknown (Activity characterized by financial lures and "Service Agreement" malspam).
## Detection Methods
- **Signature-based detection:** Monitoring for the specific hash of the `HwRwDrv.sys` driver and the Tiflux MSI installer.
- **Behavioral detection:**
- Flagging the installation of RMM tools not approved by corporate policy.
- Monitoring for unusual `msiexec` activity originating from browser downloads.
- Detecting unauthorized remote desktop traffic (VNC/RDP) initiated by RMM processes.
- **Audit:** Regularly audit installed programs for Tiflux, UltraVNC, Splashtop, or ScreenConnect if not explicitly used by the internal IT department.
## Mitigation Strategies
- **Software Restriction Policies:** Implement AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unapproved RMM installers.
- **Email Filtering:** Block incoming emails containing links to newly registered or suspicious domains (e.g., `lawdepotisland[.]com`).
- **Driver Blocking:** Enable Microsoft's vulnerable driver blocklist to prevent the loading of known-bad drivers like `HwRwDrv.sys`.
- **User Training:** Educate staff on identifying sophisticated phishing pages that utilize CAPTCHA-like gates to deliver malicious payloads.
## Related Tools/Techniques
- **ScreenConnect / Splashtop / PDQ / GoTo Resolve:** Other commercial tools frequently abused in "Rogue RMM" campaigns.
- **DLL Side-Loading:** Often used in conjunction with these tools to execute malicious code within the context of a legitimate process.