157. Aspia: An RMM in a Partisan Hands
Hello everyone! I have an addition to your hunting collection related to RMMs! Yes, I know. Yes, one more. That's life! So, Kaspersky shared a report on Cyber Partisans (we track this activity cluster as Guerrilla Hyena ). Among other malware and tools, the adversary leveraged an RMM called Aspia Remote Desktop . It's interesting that this tool isn't listed on LOLRMM project, so it's a good idea to have a hunting query: event_type: "processcreatewin" AND proc_file_productname: "aspia" See you tomorrow!