{
  "family": "teamviewer",
  "sample_count": 1,
  "category": "backdoor",
  "description": "<h3>Executive Summary</h3>\nTeamViewer is a fully legitimate, commercially available remote access and support application. However, in the context of cybersecurity, a \"TeamViewer\" detection (often flagged as Riskware or HackTool) indicates the unauthorized, malicious installation or abuse of this legitimate tool by threat actors. Attackers frequently deploy TeamViewer during targeted intrusions to maintain persistent, interactive remote access to a compromised environment while completely bypassing traditional malware signatures, a tactic known as \"Living off the Land.\"\n\n<h3>Exploitation and Abuse Mechanics</h3>\nBecause TeamViewer is a signed, trusted application, it easily bypasses standard antivirus scanning. Threat actors abuse it in the following ways:\n<ul>\n<li><strong>Silent Installation:</strong> After gaining initial access (via phishing, RDP brute-forcing, or a prior malware infection), attackers often download a portable or customized version of TeamViewer. They execute it silently from the command line, suppressing the graphical user interface so the victim is unaware it is running.</li>\n<li><strong>Persistence and C2:</strong> The attacker configures TeamViewer to start automatically with Windows and sets a static, complex password for \"Unattended Access.\" This provides the attacker with a highly stable, encrypted command-and-control (C2) channel directly into the victim's desktop, utilizing TeamViewer's legitimate servers to route the traffic, easily bypassing edge firewalls.</li>\n<li><strong>Data Exfiltration and Lateral Movement:</strong> Once connected via TeamViewer, the attacker has full GUI access. They can use the built-in file transfer capabilities to exfiltrate sensitive data or execute tools to pivot laterally across the network.</li>\n</ul>\n\n<h3>Threat Impact</h3>\nThe unauthorized presence of TeamViewer is a critical security incident. It indicates that an attacker has established a highly reliable backdoor into the environment. Because the tool operates over standard HTTPS ports and utilizes legitimate infrastructure, detecting the malicious activity requires advanced behavioral monitoring.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> Configure EDR solutions to monitor for the unexpected execution of `teamviewer.exe`, especially when launched from temporary directories or with command-line flags suppressing the UI (e.g., `--silent`).</li>\n<li><strong>Network Isolation:</strong> Immediately isolate any endpoint found running an unauthorized instance of TeamViewer.</li>\n<li><strong>Application Control (Whitelisting):</strong> Enforce strict application whitelisting. If TeamViewer is not the officially sanctioned remote support tool for the enterprise, its execution should be explicitly blocked globally via AppLocker or EDR policies.</li>\n<li><strong>Forensic Review:</strong> Investigate the endpoint to determine *how* TeamViewer was installed, as this indicates a prior, deeper compromise.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Riskware.TeamViewer",
    "Tool.TeamViewer",
    "RemoteAccess.TeamViewer"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Teamviewer and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Teamviewer is classified as a Backdoor. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Teamviewer establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Teamviewer typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Teamviewer compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Teamviewer should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What remote administrative and surveillance capabilities does Riskware.TeamViewer provide to threat actors?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "As an interactive backdoor and remote access tool, Riskware.TeamViewer grants operators comprehensive control over the victim host. Common surveillance and management modules include real-time keystroke logging, desktop screen capture, remote VNC streaming, webcam and audio recording, arbitrary shell command execution, reverse proxy pivoting, and bidirectional file transfer capabilities."
      }
    },
    {
      "@type": "Question",
      "name": "How does Riskware.TeamViewer traverse firewalls and sustain resilient command-and-control (C2) connections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Riskware.TeamViewer establishes persistent outbound TCP or TLS connections back to threat actor infrastructure, effectively bypassing inbound firewall filtering. To maintain connection resilience against IP takedowns, variants frequently employ dynamic DNS services, fallback command servers, encrypted dead-drop resolvers on social platforms, or DNS over HTTPS (DoH) querying."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1219",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "Riskware / Legitimate Tool Abused",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "persistence",
    "command_and_control",
    "remote_access"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1219",
      "name": "Remote Access Software (Abusing a legitimate tool for malicious interactive access)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 Communication)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the compromised host from internal LAN and WAN environments to cut off interactive remote shell sessions established by Teamviewer.",
    "Inspect active socket listeners and outbound established network connections ('netstat -ano') to identify and sever covert TCP/UDP channels used by Teamviewer.",
    "Scan Windows Services, Scheduled Tasks, and Startup folders to locate and eliminate persistent backdoor listeners configured by Teamviewer.",
    "Invalidate all active VPN profiles, local administrator credentials, and session tokens that may have been harvested by the Teamviewer operator.",
    "Re-image the affected host using a validated golden image prior to reconnecting it to enterprise network segments."
  ],
  "what_to_avoid": [
    "Do not attempt to interact with or send messages through the Teamviewer remote terminal, as this alerts the attacker and may cause them to execute destructive anti-forensic commands.",
    "Avoid relying solely on static file signatures, as Teamviewer payloads frequently execute reflectively in memory without writing binaries to disk."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}