Sunday, May 4, 2025
HomeCyber CrimeThreat Actors Exploiting Legitimate Software For Stealthy Cyber Attacks

Threat Actors Exploiting Legitimate Software For Stealthy Cyber Attacks

Published on

SIEM as a Service

Follow Us on Google News

CAMO, or Commercial Applications, Malicious Operations, highlights attackers’ increasing reliance on legitimate IT tools to bypass security defenses, which can be used for various malicious activities like ransomware distribution, network scanning, lateral movement, and C2 establishment.

It can mislead security personnel during investigations, leading to successful compromises. Organizations should use GreyMatter Hunt packages to establish a baseline of existing IT tools, detect malicious activity, and implement appropriate mitigation measures to prevent such attacks.

The Relia Quest report highlights a significant increase in the misuse of commercial applications for malicious operations (CAMO) by threat actors.

- Advertisement - Google News

These applications, once legitimate tools for IT management and deployment, are now being exploited to advance attacks and evade detection.

It emphasizes the need for organizations to recognize and mitigate the risks associated with CAMO by implementing robust security measures, including policies, controls, and threat detection capabilities.

Decoding Compliance: What CISOs Need to Know – Join Free Webinar

By understanding the techniques used by attackers and proactively addressing these threats, organizations can better protect their valuable assets and reduce the likelihood of successful cyberattacks.

CAMO vs. LOLBAS

CAMO, a stealthy attack technique, leverages legitimate software’s intended functions for malicious purposes.

Unlike LOLBAS, which relies on native system utilities, CAMO employs open-source, freely available, or illegally modified tools, which often possess valid code-signing certificates, evading security policies.

Organizations’ incomplete tool inventories and the tools’ legitimate nature hinder detection, which allows attackers to operate undetected, complicating threat response and increasing the risk of successful attacks.

Cybercriminals frequently discuss the use of legitimate tools for malicious purposes on online forums, which found that adversaries commonly employ software deployment tools like PDQ Deploy, cloud storage tools like Rclone, network scanners like SoftPerfect, and remote management tools like AnyDesk for covert operations.

Forum user asks for advice on resolving PDQ Deploy issues

These tools offer advantages like evading detection and reducing the barrier to entry for less skilled attackers, reads the Relia Quest report.

The widespread sharing of cracked versions of these tools further facilitates their abuse, enabling attackers to launch damaging attacks without significant investment.

The threat actors in the analyzed cases employed CAMO techniques to avoid detection and hinder investigations.

By leveraging legitimate tools like PDQ Deploy and Total Software Deployment, they blended malicious actions into routine network operations.

Total Software Deployment user interface

PDQ Deploy was used to spread ransomware, while Total Software Deployment facilitated lateral movement through the installation of ScreenConnect.

These CAMO tools challenged traditional defensive measures, emphasizing the importance of implementing network segmentation and application whitelisting to mitigate such threats.

AnyDesk user interface

The “Inc Ransom” and “Black Basta” ransomware groups exploited legitimate IT tools, SoftPerfect and AnyDesk, to compromise systems and exfiltrate data.

SoftPerfect was used to scan networks and identify vulnerabilities, while AnyDesk provided remote access for malicious activity that was employed to evade detection and blend into legitimate operations.

According to Relia Quest, to mitigate these threats, organizations should block unauthorized cloud services, restrict RMM tools, and monitor suspicious activity.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Varshini
Varshini
Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Latest articles

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Threat Actors Use AiTM Attacks with Reverse Proxies to Bypass MFA

Cybercriminals are intensifying their efforts to undermine multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) attacks,...

Threat Actors Target Critical National Infrastructure with New Malware and Tools

A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

TerraStealer Strikes: Browser Credential & Sensitive‑Data Heists on the Rise

Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the...

MintsLoader Malware Uses Sandbox and Virtual Machine Evasion Techniques

MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool...

Threat Actors Use AiTM Attacks with Reverse Proxies to Bypass MFA

Cybercriminals are intensifying their efforts to undermine multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) attacks,...