{
  "family": "remoteadmin",
  "sample_count": 95,
  "category": "hacktool",
  "description": "RemoteAdmin (cataloged across security vendors under detections including RiskWare:Win32/RemoteAdmin, HackTool:Win32/RemoteAdmin, and Win32/RemoteAdmin) is a generic classification designating commercial or open-source remote administration tools (such as Radmin, UltraVNC, RMS, or TeamViewer components) deployed or abused in unauthorized contexts. While remote management software is legitimately used by network administrators for remote technical support and server management, threat actors frequently weaponize modified or silently packaged builds to maintain persistent, covert remote access to compromised endpoints. When deployed as a dual-use hacktool or backdoor, RemoteAdmin components execute hidden background services, configure local Windows Firewall exceptions to permit inbound remote desktop and shell connections, and conceal user interface windows to prevent the local user from observing active remote sessions. This allows unauthorized attackers to transfer files, execute terminal commands, view user screens, and exfiltrate sensitive data while bypassing standard malware heuristics due to the valid digital signatures often present on legitimate binaries.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "RiskWare:Win32/RemoteAdmin",
    "HackTool:Win32/RemoteAdmin",
    "Win32/RemoteAdmin",
    "HackTool:Win32/RemoteAdmin!MSR"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is RiskWare:Win32/RemoteAdmin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "RemoteAdmin is a riskware classification for remote administration utilities that are detected in unauthorized or suspicious locations on a system."
      }
    },
    {
      "@type": "Question",
      "name": "Is RemoteAdmin always malicious?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, it represents dual-use software; however, attackers frequently install it without user consent to establish covert remote backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "What risks arise if an unauthorized RemoteAdmin tool is running?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers gain complete remote desktop control, allowing them to capture screens, steal files, run commands, and execute additional malware."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers deploy RemoteAdmin on victim endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through silent installation parameters bundled with trojans, phishing lures, or secondary execution following network intrusion."
      }
    },
    {
      "@type": "Question",
      "name": "How should system administrators handle RemoteAdmin alerts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Verify whether the software was installed by authorized IT staff; if not, immediately terminate the service, block network ports, and investigate endpoint logs."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1219",
    "T1021.001",
    "T1543.003",
    "T1562.004",
    "T1059.003",
    "T1113",
    "T1005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software",
      "tactic": "Command and Control"
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the attacker's interactive, GUI-based remote access session.",
    "Identify the specific Remoteadmin tool utilized (e.g., TeamViewer, ScreenConnect) and uninstall the software and its associated Windows Services.",
    "Review the specific tool's log files (often found in `%AppData%` or `%ProgramData%`) to determine the duration of the unauthorized access and the attacker's origin IP.",
    "Implement application whitelisting (e.g., AppLocker) to strictly block the execution of unapproved commercial remote access tools enterprise-wide."
  ],
  "what_to_avoid": [
    "Do not assume the presence of a commercial RAT is legitimate IT activity without explicit verification from the support desk.",
    "Avoid merely stopping the service; the attacker will have likely used the interactive access to deploy secondary backdoors (like Cobalt Strike)."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Unauthorized Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Trojan Droppers",
    "Post-Exploitation Lateral Movement",
    "Unauthorized IT Tool Deployments"
  ],
  "target_platforms": [
    "Windows Server 2022",
    "Windows Server 2019",
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ],
  "capabilities": [
    "Remote Desktop Control",
    "Bidirectional File Transfer",
    "Command Shell Execution",
    "Firewall Rule Manipulation",
    "Covert Background Service Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Service Binary",
      "Device Driver"
    ],
    "network_signatures": [
      "Inbound/outbound traffic on specialized remote control ports (e.g. TCP 4899, 5900)",
      "Direct TLS-encrypted administrative session handshakes"
    ],
    "evasion_techniques": [
      "Use of legitimate, validly signed binaries (Living-off-the-Land dual-use)",
      "Hidden GUI and silent service registration"
    ],
    "persistence_mechanisms": [
      "Windows Service registration (services.exe)",
      "Registry Run keys in HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Total endpoint takeover, unauthorized administrative access, sensitive data exfiltration"
  },
  "lineage": {
    "derived_from": [
      "Commercial Remote Administration Utilities"
    ],
    "variants": [
      "RemoteAdmin.Radmin",
      "RemoteAdmin.VNC",
      "RemoteAdmin.RMS"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3d2c1b0a9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c",
      "8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c3b2a1f0e9d8c7b6a5f4e3d2c1b0a9f8e7d"
    ],
    "delivery": [
      "radmin_silent.exe",
      "remote_setup.exe"
    ],
    "persistence": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\RadminServer",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RemoteAdmin"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - RiskTool.Win32.RemoteAdmin",
      "url": "https://threats.kaspersky.com/en/threat/RiskTool.Win32.RemoteAdmin/"
    },
    {
      "name": "Malwarebytes Labs - RiskWare.RemoteAdmin",
      "url": "https://www.malwarebytes.com/threats/riskware"
    }
  ]
}