StreamerMalware
ransomwareFrom MISP Galaxy
Last reported 30 days ago, by Microsoft Security Blog2 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1219Remote Access Tools
“…illustrated in Figure 1, the Huntress 2025 Cyber Threat Report provides insight into what Huntress has observed as the top abused remote access tools.”
- T1021.001Remote Desktop Protocol
“Discovery and lateral movement tools, including NetScan, Nmap, PsExec, Impacket, NetExec, and Remote Desktop Protocol (RDP) batch scripts”
- T1098Account Manipulation
“…Agent along with MeshCentral as an operational bridge between initial hands-on-keyboard activity and later-stage actions, such as account manipulation, discovery, credential access, security tampering, and ransomware deployment.”
- T1110Brute Force
“…d on 7 Feb 2025, evidence indicated that UltraVNC had been installed on 14 May 2023, and that since that time, it had been subject to brute force password guessing attacks.”
- T1110.001Password Guessing
“…, evidence indicated that UltraVNC had been installed on 14 May 2023, and that since that time, it had been subject to brute force password guessing attacks.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments“Storm-2570 uses AteraAgent to issue commands and to further download and install Splashtop Streamer in compromised environments.”
-
Tales of Too Many RMMs“Shortly after the installation was completed, the file C:\Windows\TEMP\unpack\setup.msi was launched, successfully installing SplashTop Streamer.”
Thanks — we review every report.