Russian Hackers Bypass EDR to Deliver a Weaponized TeamViewer Component

TeamViewer’s popularity and remote access capabilities make it an attractive target for those seeking to compromise systems for their gain.

Threat actors target TeamViewer for their illicit purposes because it is a widely used remote desktop software with potential security weaknesses. 

Exploiting vulnerabilities in TeamViewer can provide unauthorized access to systems and sensitive data, enabling cybercriminals to carry out various malicious activities, such as data theft, financial fraud, or even using compromised systems to launch attacks on other targets.

In late 2022, QiAnXin Threat Intelligence Center identified a new threat actor group using fake software download sites with manipulated search rankings to distribute unofficial but seemingly valid installation packages created with Inno Setup.

Russian Hackers Bypass EDR

Attribution was challenging due to the attackers’ complex attack chain and manual operations. 

In mid-2023, TeamViewer’s DLL Sideloading was delivered via SFTP, hinting at a connection to the attacks on security researchers in 2021.

Phishing activity timelinePhishing activity timeline
Phishing activity timeline (Source – Qianxin)

The execution chain focuses on SSH reverse tunnels, leveraging OpenSSH to bypass EDR endpoint detection. 

Attackers employed sftp-server.exe to deliver the TeamViewer hijacking component, revealing the use of MINEBRIDGE RAT. 

AnyDesk and PsExec were also used for lateral propagation, with data decryption occurring within the victim’s user context.

Attack chain (Source – Qianxin)

In total, four legitimate signatures were used in this phishing operation, some still valid in the report, with an enigmatic use of Amadey Trojan.

  • GUTON LLC: FC2BDF5BD23470669F63B9A5BAE6305160DCBC67
  • NTB CONSULTING SERVICES INC: A05536924F1BA8F99BA6B1AA3C97B809E32A477E
  • OOO RIMMA: A1C753F5271F24B8067AC864BB4192C37265840C
  • KATEN LLC: 9A865A28A85CABC3F79C88BE54AF3B20962BC35C

Researchers uncovered a new MINEBRIDGE RAT variant with LLVM obfuscation, removing old C&C instructions. 

The sample retrieves a DLL from the server to execute PowerShell commands for SSH component download, consistent with previous scripts.

Attribution

The group has been active since 2021 based on domain registration times. They used Cloudflare CDN to obscure their IP, but few OSINT reports on MINEBRIDGE made tracking challenging.

QiAnXin’s data shows that the malicious domains communicated with both corporate dedicated lines and home broadband in mainland China during their Cloudflare CDN phase.

The enterprises involved were in the following sectors:-

  • Cryptocurrency
  • Electronic components
  • Technology
  • Investment
  • Healthcare

Recent findings suggest Storm-0978 (RomCom), TA505, and MINEBRIDGE have strong connections, possibly indicating shared activities beyond economic motivations.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

23 hours ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

23 hours ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

23 hours ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

23 hours ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

1 day ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

1 day ago