Splashtop Inc.

So it gets installed along with this Tyflux RMM.

And there was some scripting within the installer that once it installs itself and it installs VNC and it puts this driver on the machine, It then runs a script, and the script was to go out and pull down a copy of Splashtop, which is another RMM.

And it would pull that off of an IP address where the threat actor was hosting it, just parking it there as a dead drop.

And then the fun thing with that was, leaving it running for several hours...

It then pulled down Screen Connect, and it ran a fifth.

So we got Tyflux, VNC, and this weird driver, and then Screen Connect and Splashtop.

So four RMMs and a vulnerable kernel driver that can elevate the privileges of anything else that the threat actor chooses to do.

So we did a little bit of looking.

But bad guys, if a bad guy's made it to the endpoint and they want to pivot, they're not going to use RDP.

They're going to They're probably going to bring their own remote management tool like ServiceNow or Splashtop or something.

So how does NLA network level authentication figure into this discussion?

Your architecture will dictate that as well.

It's the access you've already granted and stopped thinking about.

That's really interesting because, as you know, a lot of these server-based products have you know, some of them have APIs, other ones don't have APIs and they have to, as you said, remote in and they have products like Splashtop or Splash Desktop.

I mean, I'm sure you can name some of the other products that sit on your server, giving a company access to the data.

So I'm curious, what is the solution to that problem if somebody's using some software and they They need to have open access for whatever reason.

Yeah, so APIs are a little bit different because it's encrypted traffic.

So yeah, that's a little bit different.

But I'm talking about like those remote access tools like TeamViewer, Splashtop, AnyDesk, any of those that just sit there running.

Really, that's like an open door for a hacker to get in if that vendor should get breached or should those credentials be compromised.

Let's go down the list here.

AuthID, Blueprint AI, Data Quality Analysis, Druva, Agile Media ARC, Endpoint Central, IBM Instana, Itential Automation Services, Licensing Engine, Now Assist for Digital End User Experience, or DEX, Process Automation Designer, Rescue by LogMeIn, I'm gonna scroll down for the rest of them, Sectigo Certificate App Connector, ServiceGraph Connector for, the tool tip is over, I can't read it, ServiceGraph Connector for Meraki, Splashtop On-Demand Support, Subscription Management V2, TeamViewer DexCore, TeamViewer Dex ITSM Connect, Virtual Agent Identity Verification by IDRAMP, and Yansa Barcode and QR Code Generator.

And that was our minor updates, 20 of them for this week.

Nothing really to pay attention to those.

Require multi-factor authentication on anything remote access facing, VPNs, webmail, jump hosts.

And audit which remote access tools are already living in your environment because the advisory's list, again, AnyDesk, ConnectWise, Splashtop, and the rest, it's a checklist of what an affiliate will try to blend into first.

And offline immutable backups, I assume that's non-negotiable given they're deleting shadow copies and encrypting VMs.

Absolutely non-negotiable.

And this was my original setup when I said when I would retire was that I would have a Mac Mini and I would use my iPad in order to do some heavier lifting from somewhere else.

And I've achieved that, but I was having a tough time trying to find a screen connection because Splashtop doesn't really cut it anymore.

And there were a couple of others, but I found one called Screens.

And this one also works with the Vision Pro.