Russian Threat Actors Weaponize TeamViewer to Evade EDR and Hijack Enterprise Systems

Remote access tools are built for productivity — but in the wrong hands, they become powerful intrusion weapons.

Security researchers have uncovered a sophisticated campaign attributed to Russian-linked threat actors that weaponizes TeamViewer components to bypass endpoint detection and response (EDR) solutions, maintain stealthy access, and expand laterally across enterprise networks.

The campaign demonstrates a growing trend: attackers no longer need exploits when trusted software can be abused instead.

🎯 Why TeamViewer Is a High-Value Target

TeamViewer’s widespread adoption makes it an ideal attack vector. When compromised or abused, it offers attackers:

• Legitimate remote desktop access

• Encrypted communications that blend into normal traffic

• Trusted binaries that evade security scrutiny

By hijacking TeamViewer functionality, attackers gain hands-on-keyboard access without triggering traditional malware defenses.

🧨 Initial Access: Fake Downloads & Search Manipulation

Researchers at QiAnXin Threat Intelligence Center traced the campaign back to late 2022, when attackers began using:

• Fake software download websites

• Manipulated search rankings

• Trojans packaged with Inno Setup installers

The installers appeared legitimate but contained weaponized components designed to deploy malicious payloads after execution.

🛠️ EDR Evasion via SSH and Living-Off-the-Land

Once inside a system, the attackers avoided noisy malware techniques.

Instead, they relied on:

• SSH reverse tunnels

• OpenSSH utilities

• SFTP (sftp-server.exe) for payload delivery

This approach allowed them to bypass EDR detection by abusing trusted Windows and OpenSSH components rather than introducing foreign binaries.

At the core of the attack chain was DLL sideloading, where a malicious TeamViewer DLL was delivered over SFTP and loaded by a trusted process.

🐀 MINEBRIDGE RAT & Lateral Movement

The campaign deployed a heavily obfuscated MINEBRIDGE RAT variant using LLVM-based obfuscation to hinder analysis.

Key capabilities included:

• In-memory execution

• PowerShell command execution

• Downloading additional SSH components

• Credential and data decryption within the victim’s user context

For lateral movement, attackers abused:

• AnyDesk

• PsExec

• Additional remote access tooling

All actions were performed using legitimately signed binaries, reducing the chance of detection.

🔏 Abuse of Valid Code Signing Certificates

One of the most concerning findings was the use of multiple valid digital signatures during the operation — some of which were still trusted at the time of reporting.

Certificates observed included:

• GUTON LLC

• NTB Consulting Services Inc

• OOO Rimma

• KATEN LLC

This allowed malicious binaries to pass trust checks and bypass application control policies.

🧠 Attribution & Targeted Industries

Attribution remains complex due to:

• Manual, hands-on operations

• Cloudflare CDN usage to mask infrastructure

• Sparse OSINT visibility into MINEBRIDGE

However, domain registration timelines indicate activity dating back to 2021, with overlaps linked to known groups such as:

• Storm-0978 (RomCom)

• TA505

• MINEBRIDGE

Targeted industries included:

• Cryptocurrency

• Technology & electronics

• Investment firms

• Healthcare organizations

🛡️ The Elliptic Systems Perspective

This campaign reinforces a critical reality:

EDR alone cannot stop attackers who abuse trusted tools.

At Elliptic Systems, we see this pattern repeatedly:

• Legitimate software used as malware

• Signed binaries bypassing controls

• Remote access tools becoming persistence mechanisms

To reduce risk, organizations should:

• Restrict and monitor remote access tools (TeamViewer, AnyDesk, PsExec)

• Enforce application allowlisting with behavior monitoring

• Alert on SSH tunneling and unexpected SFTP activity

• Correlate DLL sideloading with signed-but-untrusted behavior

👉 Schedule an Endpoint & EDR Evasion Assessment

⚠️ Final Takeaway

This was not a zero-day attack.
It was a trust-abuse operation.

By blending into legitimate workflows and abusing signed software, attackers bypassed defenses designed to stop “malware” — not misuse.

Security teams must shift focus from what is running to how it’s being used.

Elliptic Systems — Defending Where Trust Is Exploited.