Adversaries are leveraging remote access tools now more than ever — here’s how to stop them
Summary: Cisco Talos Incident Response reported that AnyDesk appeared in all ransomware and pre-ransomware engagements in its third-quarter 2023 Quarterly Trends report, and noted that use of remote management tools like AnyDesk and TeamViewer has grown sharply since 2020. Talos said these tools are easy to install, hard to detect as legitimate software, and often run over ports 80 and 443, while adversaries rename executables and vendors change server IPs, limiting hash, filename, and static IP blocks.
What's compelling: AnyDesk showed up in every ransomware and pre-ransomware engagement Talos IR handled in Q3 2023, so an unapproved remote access tool on a single endpoint is a direct path into a ransomware affiliate's attack chain. Talos notes that only WDAC and AppLocker, in their most restrictive allowlist configuration, offer near-total protection against unauthorized remote management software execution.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026