MexicanMafia AnyDesk N-able RMM LNK Impersonation for Persistent Access

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.