Hackers misuse UltraVNC, Splashtop and ScreenConnect to hijack business PCs
Huntress uncovered a phishing campaign that provided legitimate RMM tools (Tiflux, UltraVNC, Splashtop, ScreenConnect) to gain persistence and exfiltrate business data Attackers lure victims with fake “Network Solutions” service agreement emails, then exploit a vulnerable driver (HwRwDrv.x64) for privilege escalation Evidence points to Brazilian infrastructure and targets where defenses depend on rigorous RMM auditing, asset […]
Hackers misuse UltraVNC, Splashtop and ScreenConnect to hijack business PCs Read More »









