Remotemanipulator

Overview

HackTool:Win32/Remotemanipulator (commonly known as **RMS** or **Remote Manipulator System**) is a legitimate, commercial Remote Administration Tool (RAT) similar to TeamViewer or AnyDesk. While it is marketed as a legal IT support utility, RMS is heavily and aggressively abused by threat actors (including APTs and ransomware gangs) to establish persistent, high-privilege backdoors into corporate networks while blending in with legitimate administrative traffic.

Understanding RMS Abuse
To an end-user, RMS is largely invisible; threat actors deploy the 'Host' module silently without a GUI. For a security analyst, the unapproved presence of RMS is a critical incident. Because RMS is legally signed software (`T1553.002`), it routinely bypasses static antivirus signatures. Attackers use it to bypass network firewalls, utilizing the vendor's legitimate cloud relay servers to establish a reverse connection back to the attacker, eliminating the need for complex port forwarding.

Execution and Legitimate Tool Abuse
RMS is typically dropped as a secondary payload after initial access is gained via phishing (`T1566.001`) or RDP brute-forcing (`T1110`). Attackers deploy a customized, pre-configured MSI installer of the RMS Host module. They use command-line switches to install it silently (`T1059.004`), hiding the tray icon and disabling user prompts. Once installed, it establishes persistence as a high-privilege Windows Service (`T1543.003`). The host connects out to the legitimate RMS infrastructure (often `tektonit.ru` or associated IPs) (`T1071.001`). The attacker connects to the same infrastructure using the 'Viewer' module, granting them full GUI control, file transfer (`T1041`), and command execution capabilities on the victim machine, completely bypassing perimeter ingress filtering.

Indicators of Compromise & Impact
The impact is total, interactive remote control of the endpoint, almost always preceding lateral movement or data exfiltration. The primary IoC is the execution of `rutserv.exe` or `rfusclient.exe` (the core RMS binaries), especially if launched silently from a temporary directory. Network analysts should look for sustained outbound TCP traffic to known RMS relay servers. EDR logs will flag the silent installation of the 'Remote Manipulator System' service.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_REMOTEMANIPULATOR_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Remotemanipulator"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "remotemanipulator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Remotemanipulator (Ransomware) Execution & Triage
id: b23a1a2e-4dd8-5421-91d3-8b0b414c9541
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Remotemanipulator malware family. Detects volume shadow copy deletion,
  boot status tampering, and recovery inhibition characteristic of modern ransomware
  operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/remotemanipulator
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1071_001
- attack.t1543_003
- attack.t1219
- attack.t1553_002
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

rule MALWARE_WIN_REMOTEMANIPULATOR_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Remotemanipulator tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "remotemanipulator" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; active RMS traffic indicates an attacker is currently 'hands-on-keyboard' in the network.
2. Use the Windows Service Manager (services.msc) or EDR to forcefully stop and disable the 'Remote Manipulator System' service.
3. Block all known RMS relay domains and IP addresses at the enterprise firewall to sever the attacker's connection.
4. Perform a deep forensic review; if RMS is present, the attacker has already gained initial access and likely dumped local credentials.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the software is benign just because it is digitally signed or classified as a 'HackTool' rather than a Trojan; in the hands of an attacker, it is a devastating backdoor.
2. Avoid closing the incident simply by uninstalling RMS; you must investigate *how* the attacker deployed it in the first place.

References & External Analysis

• Search "remotemanipulator" on VirusTotal (External Analysis)
• Search "remotemanipulator" on Any.Run (Sandbox Sandbox)
• Search "remotemanipulator" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Ransomware)

Explore other documented threats in the same operational category:

• Pcvark
• Genericrxft
• Dorgam
• Swpatch
• Vools
• Bmsdus4Ufhei
• Genasom
• Haperlock

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/remotemanipulator.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.