lolrmm[.]ioDomain
Reported by 3 independent sources · first reported by Huntress · last reported
Last reported 23 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
ScreenConnect Client (Ab)used by Attackers, (Thu, Oct 1st)“[2] hxxps://lolrmm[.]io”
-
The dual-use dilemma: Rethinking detection for remote access tool abuse“Baseline your environment: Use resources like LOLRMM[.]io and the Ransomware Tool Matrix’s RMM tools section to understand what legitimate RMM usage looks like in your organization and what threat groups are using what tools.”
-
How Threat Actors Abuse Remote Management Tools“Community-driven resources like lolrmm[.]io help support this approach by providing shared visibility into commonly abused platforms.”
Indicators reported together
named in the same reports- remotedesktop[.]comin 1 report
- syncroapi[.]comin 1 report
- kabutoservices[.]comin 1 report
- hxxps://server.rarexterna[.]top/Bin/ScreenConnect.ClientSetup.msiin 1 report
- server.rarexterna[.]topin 1 report
- pdq[.]comin 1 report
- business.gogift[.]comin 1 report
- 209.160.115[.]150in 1 report
- 98.97.79[.]68in 1 report
- 105.113.63[.]173in 1 report
- 93.152.214[.]210in 1 report
- 79f25a73e056ecb8…d395453c9c48in 1 report
- 83a8c175cdab60d0…939873416adcin 1 report
- 42ef97c8260f9f28…19159bfe5ebein 1 report
- 429cbc557b1a9c8c…b386ccdb679ain 1 report
- db341aaa9cd902b1…a20404f1d90bin 1 report
- ca9ac952feaaa5cb…066703de6955in 1 report
- 22006710eaad12c4…83eed7f3e7dein 1 report
- ec2bdcd616d9dcfb…b5a9fc69e879in 1 report
- 1a0769b8445cc27e…b0fb2bdfe0efin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.