Storm-2561 - Fake VPN Installer Spawning RMM (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•3

Detects SEO-poisoned fake VPN installers (GlobalProtect, Cisco AnyConnect) dropping and silently executing legitimate RMM tools (NetSupport, ScreenConnect) as a persistence backdoor.