How Nightwatch followed a fake remote-support lure to two PCs under an outside operator's control.

An attacker who wants hands on a keyboard doesn't always need malware. A convincing message from "IT support" and a legitimate remote-desktop tool can give them an interactive session on a corporate PC, under the user's own account. Ransomware operators pay for that kind of access, and some crews recruit callers specifically to produce it.

This investigation started with a report about one of those crews. None of the report's searched indicators appeared in the environment, so Nightwatch searched for the behavior the report described:

…a user persuaded to start a remote-support tool.

That search led to two front-office PCs where a "quick assistance" lure had installed a RustDesk client pointed at an attacker-run server. The operator then raised the sessions to administrator and SYSTEM rights. No alert named the activity.

The map groups recorded evidence checks for readability, without claiming exact query timing. Customer identifiers, attacker infrastructure and timestamps are omitted. The footer summarizes follow-up activity described in the last section.

Remote-support lures and self-hosted servers

Remote monitoring and management (RMM) and remote-desktop tools are signed software that most corporate networks already expect to see. A 2023 joint advisory from CISA, NSA and MS-ISAC warned that portable RMM software lets attackers avoid admin rights and software controls, and that its use generally doesn't trigger antivirus defenses (AA23-025A). In May 2024, Microsoft described Storm-1811 posing as IT support in voice-phishing calls, walking users into Quick Assist sessions and later deploying Black Basta ransomware (Microsoft Threat Intelligence).

RustDesk adds a self-hosting option. Anyone can run their own RustDesk server, and the project notes that its public-server restrictions don't extend to private deployments (RustDesk). A client configured for an attacker's server doesn't use the vendor's public relays, so controls built around those relays won't see it.

For defenders, the hard part is telling these sessions apart from the remote support that IT teams run every day. This is where Nightwatch steps in.

Frame the hunt around the behavior

The threat intel report submitted on the Intel Exchange described a crew that recruits callers to talk employees into remote-support sessions, then hands that access to ransomware operators. Nightwatch admitted the report for hunting and checked which telemetry could answer its questions.

The exact indicators from the campaign came first. Nightwatch searched 30 days of DNS, network, file and email records for the report's domains, addresses, hashes, file names and sender addresses. None of the searched values matched. Two could not be searched in their exact listed form, so the indicator check stayed open instead of counting as clean.

Next, the report's malware steps also came back empty or explained. Searches for credential tools, screen-capture traces and the report's DLL download pattern found nothing.

Registry hive saves and bursts of discovery commands did appear, and Nightwatch traced them to a security agent and a help-desk agent already deployed in the environment. Microsoft Teams audit logs were not connected, so the report's Teams-based help desk pretext could not be assessed. Nightwatch recorded that as a gap in the data, separate from a search that found nothing.

The remaining question was whether anyone had been persuaded to start a remote-support tool. Nightwatch counted Quick Assist, AnyDesk and HopToDesk starts over 14 days, grouped by the process that launched each one.

Separate unfamiliar tools from everyday support

AnyDesk runs on hundreds of the organization's PCs, so Nightwatch looked at how each launch began. Quick Assist had run only four times. A few AnyDesk launches came from a browser download or a renamed copy in a user's Downloads folder, instead of an installed client. Nightwatch listed the shells, installers and script hosts started on those PCs after each launch.

Two PCs at one site stood out. On each, a user had opened a zip file named for assistência rápida (Portuguese for "quick assistance"), one from an email link and the other from a WhatsApp message. A batch file inside used curl to download RustDesk:

Read what the operator did

Nightwatch listed every process RustDesk started on the two PCs and removed browser, updater and patch-agent noise from the results.

On one PC, RustDesk opened PowerShell for the operator. On the other one, it relaunched itself to run as SYSTEM. On both, the operator started AnyDesk from the user's Downloads folder and got a Windows elevation prompt approved for the site's administrator account.

An AnyViewer installer later ran silently on one PC, and RustDesk held its connection to an outside address for about 80 minutes. Some of the operator's commands adjusted the clock and time zone, which fits a trust-building ruse the report described: fix a small, visible problem while the session is open.

During one session, a SYSTEM-level PowerShell created a local account and added it to the administrators group. Nightwatch searched for that account across the fleet and traced it to a Group Policy script that creates it on PCs across the site. The account was left out of the finding.

Settle the IT-support question

Two earlier hunts, framed around unrelated reports, had already crossed the same batch file while following dynamic DNS lookups and browser-launched shells.

Each one flagged it with the same doubt:

• The session might belong to an outside technician.
• A self-hosted support tool
• An administrator prompt and a remote shell can all describe legitimate IT work.

The help-desk impersonation report gave Nightwatch a frame that fit the activity, and the team supplied the missing fact: none of the IT providers at that site uses RustDesk.

With that confirmation, the finding moved from a lead to verify to a recommendation to contain the two PCs, confirm the sessions with the site and reset the administrator password.

Turn the finding into coverage

The finding came with two detection proposals, each tested against retained telemetry before it was offered.

1. The first updated an existing library detection for PowerShell downloads. It kept the original condition and added curl writing an executable, DLL, DAT or MSI file, or downloading from a bare IP address.
2. The second detection opportunity targeted the session pattern: a remote-access tool started from a user profile that later elevates itself, all funneled through a Windows consent prompt or a relaunch as SYSTEM. The rule ties both steps to the same copy of the tool on the same host and requires the user launch to come first. Its 15-day trial returned eight alerts, including both PCs. Nightwatch also examined the other matches, AnyDesk copies run alongside what appeared to be technician accounts at another site, as possible routine support. A list of approved remote tools would supply the rule's main exclusion.

An earlier version of the new rule linked the steps through process identifiers and matched none of the hosts in the finding, so Nightwatch held it back. Both remaining proposals went to the team for review, and the reviewed record does not show either one saved or deployed. Deployment to the SIEM needs the team's approval.

Keep watching after the report

Follow-up runs kept the case open. Nine days after the lure, a third PC at the same site ran AnyDesk from a Downloads folder with repeated elevation prompts and connected to the same outside address the first two sessions had used.

That PC also made a direct connection to an internal address on AnyDesk's port, so a sanctioned IT session remained possible. The following week, a local account created during a later session on that PC relaunched AnyDesk, and a hunt framed around a ransomware report added domain discovery commands from the same session to the record. That thread stayed open pending confirmation from the site's IT provider.

Later hunts on unrelated reports matched the original lure again and recognized it as already reported.

Evidence scope

The reviewed material establishes the delivery route:

• the RustDesk and AnyDesk sessions
• elevation to administrator and SYSTEM rights
• the absence of a matching alert in the sources and period checked.

It does not establish a connection to the crew in the source report, or any ransomware activity. The telemetry does not show whether a phone call accompanied the links.

The dynamic DNS server and the downloaded client were not recovered for analysis. Remote-support social engineering is publicly documented; this case concerns the local discovery of an attacker-run server and the sessions it controlled.

Examine remote access in your own telemetry

Nightwatch's Adaptive Threat Discovery searched for the report's behavior after its indicators came back empty, then used each artifact it found to choose the next search. The team's answer about RustDesk turned a possible support session into a containment case.

The free Nightwatch Risk Assessment includes a 30-day backtest of available telemetry. Use it to examine remote-access tools started from user profiles in your own data. Which sessions elevated themselves, and which can your IT.