<![CDATA[(huntress.com) Threat Actors Exploit Tiflux RMM in Phishing Campaigns for Stealthy Persistence and Privilege Escalation]]>(huntress.com) Threat Actors Exploit Tiflux RMM in Phishing Campaigns for Stealthy Persistence and Privilege Escalation

Threat actors are actively exploiting Tiflux, a commercial RMM tool, in phishing campaigns for initial access and persistence since late February. The campaign chains Tiflux with UltraVNC, Splashtop, and ScreenConnect for covert operations.

In brief - Huntress researchers identified a surge in incidents involving Tiflux RMM abuse via phishing. The installer includes vulnerable components like HwRwDrv.sys, enabling privilege escalation and system compromise. Organizations must monitor RMM tool usage to prevent unauthorized access.

Technically - The attack begins with a phishing email leading to a CloudFlare CAPTCHA-protected page delivering a malicious MSI installer. The installer deploys TiAgent, TiPeerToPeer, and outdated UltraVNC (v1.2.0.1) with hardcoded credentials. Vulnerable drivers (HwRwDrv.sys) and registry modifications disable security notifications, while additional RMM tools (Splashtop, ScreenConnect) facilitate credential theft and system profiling. Expired certificates and SSH host keys further indicate malicious intent.

Source: https://www.huntress.com/blog/tiflux-rmm-install

]]>https://board.circlewithadot.net/topic/ff263ecb-a186-410b-b3ff-f4dfe42ec42a/huntress.com-threat-actors-exploit-tiflux-rmm-in-phishing-campaigns-for-stealthy-persistence-and-privilege-escalationRSS for NodeThu, 14 May 2026 22:36:52 GMTFri, 08 May 2026 00:31:24 GMT60