As cited
Copy frozen at (site build).
threat intel
The Fake Agent Was Just the Delivery Truck
Attackers used a fake IT agent masquerading as a legitimate entity to install remote-support tools on target systems. This tactic emerged as the most common objective in September data from the Recorded Future Outpost Campaign (ROC). The remote-support tool served as the actual payload, with initial access via social engineering.
Why it matters: Security teams and users should recognize that fake IT agents requesting system access are a primary vector for remote-support tool deployment, which enables persistent access and lateral movement; train staff to verify IT requests through independent channels.
- Source published
- First seen by Cybersecurity Tracker