{
  "family": "remotemanipulator",
  "sample_count": 9,
  "category": "ransomware",
  "description": "HackTool:Win32/Remotemanipulator (commonly known as **RMS** or **Remote Manipulator System**) is a legitimate, commercial Remote Administration Tool (RAT) similar to TeamViewer or AnyDesk. While it is marketed as a legal IT support utility, RMS is heavily and aggressively abused by threat actors (including APTs and ransomware gangs) to establish persistent, high-privilege backdoors into corporate networks while blending in with legitimate administrative traffic.<br><br><b>Understanding RMS Abuse</b><br>To an end-user, RMS is largely invisible; threat actors deploy the 'Host' module silently without a GUI. For a security analyst, the unapproved presence of RMS is a critical incident. Because RMS is legally signed software (`T1553.002`), it routinely bypasses static antivirus signatures. Attackers use it to bypass network firewalls, utilizing the vendor's legitimate cloud relay servers to establish a reverse connection back to the attacker, eliminating the need for complex port forwarding.<br><br><b>Execution and Legitimate Tool Abuse</b><br>RMS is typically dropped as a secondary payload after initial access is gained via phishing (`T1566.001`) or RDP brute-forcing (`T1110`). Attackers deploy a customized, pre-configured MSI installer of the RMS Host module. They use command-line switches to install it silently (`T1059.004`), hiding the tray icon and disabling user prompts. Once installed, it establishes persistence as a high-privilege Windows Service (`T1543.003`). The host connects out to the legitimate RMS infrastructure (often `tektonit.ru` or associated IPs) (`T1071.001`). The attacker connects to the same infrastructure using the 'Viewer' module, granting them full GUI control, file transfer (`T1041`), and command execution capabilities on the victim machine, completely bypassing perimeter ingress filtering.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total, interactive remote control of the endpoint, almost always preceding lateral movement or data exfiltration. The primary IoC is the execution of `rutserv.exe` or `rfusclient.exe` (the core RMS binaries), especially if launched silently from a temporary directory. Network analysts should look for sustained outbound TCP traffic to known RMS relay servers. EDR logs will flag the silent installation of the 'Remote Manipulator System' service.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Remotemanipulator and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remotemanipulator is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Remotemanipulator establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remotemanipulator typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Remotemanipulator compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Remotemanipulator should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does Remotemanipulator employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remotemanipulator typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for Remotemanipulator, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for Remotemanipulator depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1071.001",
    "T1543.003",
    "T1219",
    "T1553.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Abusing legitimate RMS for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (RMS Host Service)",
      "tactic": "Persistence"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol (Using RMS cloud relays for C2)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1553.002",
      "name": "Subvert Trust Controls: Code Signing (RMS is digitally signed)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint; active RMS traffic indicates an attacker is currently 'hands-on-keyboard' in the network.",
    "Use the Windows Service Manager (services.msc) or EDR to forcefully stop and disable the 'Remote Manipulator System' service.",
    "Block all known RMS relay domains and IP addresses at the enterprise firewall to sever the attacker's connection.",
    "Perform a deep forensic review; if RMS is present, the attacker has already gained initial access and likely dumped local credentials."
  ],
  "what_to_avoid": [
    "Do not assume the software is benign just because it is digitally signed or classified as a 'HackTool' rather than a Trojan; in the hands of an attacker, it is a devastating backdoor.",
    "Avoid closing the incident simply by uninstalling RMS; you must investigate *how* the attacker deployed it in the first place."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}