Spam campaign targeting Brazil abuses Remote Monitoring and Management tools
Summary: Cisco Talos observed a spam campaign targeting Portuguese-speaking users in Brazil, mostly C-level executives and finance and HR accounts, that lures victims to Dropbox-hosted installers of commercial remote monitoring and management tools, chiefly N-able RMM Remote Access and PDQ Connect. Talos confirmed the actors used 15-day free trials rather than stolen credentials, since samples older than 15 days returned disabled-account errors while newer ones were active, and N-able disabled the affected trial accounts.
Bottom line: A free trial of a signed, fully featured RMM tool gives an attacker remote desktop, command execution, screen streaming, keystroke capture and file access at no cost, and the traffic blends into the provider's own AWS-hosted infrastructure. Talos assesses this pattern as consistent with initial access brokers, who sell compromised access to actors that deploy ransomware.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026