Threat Actors Disguise Remote Management Tools as Video Files

Du'aine Davis

Observed in the wild

• Since at least October 2025, threat actors have targeted organisations by distributing malicious PDF files disguised as invoices or payment documents. These PDFs redirect victims to phishing pages mimicking Google Drive or Adobe, prompting downloads of files masquerading as MP4 videos. The downloaded payload installs Remote Monitoring and Management (RMM) tools such as Syncro, NinjaOne, SuperOps, and ScreenConnect.
• Attackers leverage legitimate RMM tools signed with valid certificates, making them harder to detect by traditional security solutions. The campaign uses phishing emails with PDF attachments, Google Drive lookalike pages, and NSIS-based downloaders to deploy RMM installers. Known actors include ransomware groups like ALPHV/BlackCat, Hive, and APT groups such as MuddyWater.
• Organisations should enforce strict email filtering, verify sender authenticity, and block suspicious links. Update operating systems and security products, including Microsoft Defender, to the latest versions. Defender should monitor for anomalous RMM installations, Advanced Installer processes, and NSIS scripts downloading additional payloads.

RMM Tools (Syncro, SuperOps, NinjaOne, etc.) Being Distributed Disguised as Video Files - ASEC