eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
(Don't) TrustConnect: It's a RAT in an RMM hat
Bottom Line: Security researchers have identified a new Malware-as-a-Service operation that mimics legitimate Remote Monitoring and Management tools. This and similar services lower the barriers of entry for new threat actors, allowing the wider adoption of cybercrime.
On February 19th, 2026, Proofpoint researchers released a report on a new Malware-as-a-Service (MaaS) platform known as TrustConnect. TrustConnect first appeared in late January 2026, when Proofpoint discovered a series of campaigns delivering what appeared to be another abused RMM tool. Upon deeper investigation, researchers confirmed that TrustConnect was not a legitimate RMM product but instead a newly developed MaaS platform designed as a Remote Access Trojan (RAT). The threat actor created a fraudulent business website on January 12th, 2026, and used it to host marketing material, documentation, and a public login portal that concealed the platform’s malicious purpose.
Threat actors began distributing TrustConnect through email campaigns. These messages originated from compromised accounts and frequently appeared in both English and French. The emails used lures related to bid invitations, meeting reminders, event notifications, tax information, and shared documents to entice recipients to click on embedded URLs.
When victims clicked these URLs, they were directed to executables named after commonly used applications such as “MsTeams.exe” or “ZoomWorkspace.exe.” These payloads were signed using a fraudulent Extended Validation (EV) certificate obtained under the fabricated company name “TrustConnect Software PTY LTD,”. Once executed, the payloads dropped the TrustConnectAgent.exe RAT. Threat actors sometimes rotated payloads mid‑campaign, wherein they delivered multiple RMM tools in parallel, including ScreenConnect and LogMeIn Resolve.
TrustConnect offers an expansive set of capabilities. These features are accessible through a centralized web-based control panel that manages victims, generates signed payloads, and tracks attacker activity. The subscription panel indicates that the monthly fee for the subscription is $300 USD, and payments can be made using the cryptocurrencies Bitcoin or USDT. The RAT supports full remote desktop control through an unauthenticated WebSocket stream. It allows operators to execute arbitrary commands, upload or download files, browse the victim’s file system, capture screens, and record activity. Moreover, the platform assigns each customer an organization-specific install token, which is embedded into the installer to ensure that compromised devices appear in the correct attacker's dashboard. The dashboard provides detailed audit logs and real-time activity tracking with no option for attackers to delete or alter forensic records. The platform also hosts branded installers designed to impersonate widely used software such as Microsoft Teams, Adobe Reader, Google Meet, and Zoom.
eSentire Threat Intelligence Analysis:
The report indicates that the operator behind TrustConnect uses a Telegram contact handle for sales and support. This handle was previously associated with Operation Magnus, a global law enforcement initiative in 2024 that targeted Redline and META stealer operations. Proofpoint assesses, with moderate confidence, that the TrustConnect operator has a history as a user or affiliate of the Redline stealer.
In this campaign, the operator obtained a legitimate Extended Validation (EV) code-signing certificate to sign the malware. This likely increased the success rates of delivery and decreased initial scrutiny from security products. Proofpoint, in collaboration with external partners, launched a coordinated disruption that affected a portion of TrustConnect infrastructure. However, the actor started testing a new RAT, DocConnect, using upgraded infrastructure by transitioning from raw WebSockets to SignalR and integrating PDF lures.
Extended Validation (EV) certificates are expensive to obtain and involve rigorous verification of the domain owner’s identity, which is intended to establish the legitimacy and trustworthiness of a business. However, when abused by threat actors, these certificates can increase the perceived credibility of malicious software and help bypass signature-based security controls. eSentire's Threat Response Unit (TRU) has also discussed this topic at SecTor in detail in a session titled Hunting Certified Imposters, highlighting the risks associated with trusted certificates being abused by threat actors.
Based on website artifacts and functionality, both TrustConnect and DocConnect websites and agents were likely coded with the assistance of AI Agents. For additional insights into how threat actors are operationalizing Large Language Models (LLMs), the eSentire TRU team has published a TRU+ blog and presented on this topic during the February 2026 Threat Intelligence Briefing (TIB).
BeyondTrust Vulnerability Actively Exploited in the Wild
Bottom Line: Threat actors have been identified targeting the recently disclosed BeyondTrust vulnerability CVE-2026-1731, with attacks leading to the deployment of RMM tools, Remote Access Trojans, webshells, and backdoors. Organizations are urged to apply relevant patches as soon as possible.
On February 19th, 2026, Palo Alto's Unit 42 published a report on observed exploitation of the critical Remote Code Execution (RCE) vulnerability, CVE-2026-1731, impacting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Unit 42 notes that successful attacks leveraging the vulnerability resulted in the deployment of the Remote Access Trojan (RAT) SparkRAT, the backdoor VShell, Remote Monitoring and Management (RMM) tools, and post-exploitation activity.
CVE-2026-1731 (CVSS: 9.9) was initially disclosed by BeyondTrust on February 6th, 2026, indicating that attacks can be triggered through “specially crafted client requests” that can allow an unauthenticated attacker to execute commands in the context of the site user. The vulnerability specifically impacts the thin-scc-wrapper component within BeyondTrust RS and PRA products, which is exposed to the network and handles incoming WebSocket connections. BeyondTrust stated that patches were automatically applied to “all instances with BeyondTrust’s update service enabled”, but that self-hosted customers would have to manually apply patches. BeyondTrust contacted self-hosted customers on February 4th and 10th, advising them to patch. Proof-of-Concept (PoC) exploit code was published on February 10th, followed by reports of exploitation shortly after.
Unit 42 indicates that attacks targeting the vulnerability have been identified within Australia, Canada, France, Germany, and the United States, against organizations in the financial, legal, high technology, higher education, wholesale and retail, and healthcare sectors. Successful exploitation has resulted in the creation of both domain and local administrator accounts, reconnaissance, deployment of webshells, malware, and RMM tools such as SimpleHelp and AnyDesk, and data theft. Specific malware that was identified includes the open-source RAT SparkRAT, the Linux backdoor VShell, and the Nezha monitoring agent.
eSentire Threat Intelligence Analysis:
Unit 42 highlights the historic precedent of threat actors targeting vulnerabilities within BeyondTrust RS and PRA products, specifically highlighting CVE-2024-12356 (CVSS: 9.8). This flaw was another unauthenticated RCE vulnerability, which could lead to command execution with site level permissions. This vulnerability was leveraged in espionage-motivated attacks by the Chinese APT Silk Typhoon, and is believed to have been the initial entry point in the U.S. Treasury Department breach in late 2024. The notion that similar BeyondTrust vulnerabilities have been abused by Chinese APT groups in the past suggests that CVE-2026-1731 could potentially be leveraged by APT groups, either in ongoing or future attacks.
Unit 42 does not provide any attribution to the identified attacks, or provide any details on if they are related, only highlighting that they impact a wide range of industries across various countries. The usage of the Nezha monitoring agent is notable, as it is an open-source tool that was initially developed for the Chinese IT community and has been previously identified in attacks, but with no specific links to APT groups. SparkRAT and VShell are other open-source malware used in the reported attacks, meaning that they are publicly available for use. The motivation behind the reported attacks appears to have been the exfiltration of sensitive data, specifically “configuration files, internal system databases and a full PostgreSQL dump”, which could potentially be used during the attack for lateral movement, or sold to a third-party attacker to operationalize. Publicly available PoC exploit code for vulnerabilities lowers the barrier of entry for attackers of all skill levels to utilize within attacks. PoC for CVE-2026-1731, along with the deployment of open-source tooling identified within the attacks highlights this notion, as the exploit and identified tools are readily available to be used.
Following the initial reports of exploitation, CISA added CVE-2026-1731 to its Known Exploited Vulnerabilities (KEV) catalog on February 13th, giving federal agencies a deadline of February 16th to apply relevant patches. Due to the publicly available PoC and reports of ongoing exploitation, organizations should ensure that relevant patches are applied immediately. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-1731, and eSentire MDR for Network has detections in place to identify exploitation attempts.
Chinese APT Exploits Dell RecoverPoint Zero-Day Vulnerability for Two Years
Bottom Line: A PRC actor (UNC6201) has been observed exploiting a zero-day vulnerability in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) since mid-2024 to deploy backdoors to vulnerable devices.
On February 17th, 2026, Dell disclosed the existence of a maximum severity zero-day vulnerability that impacts RecoverPoint for Virtual Machines, a popular cyber resilience software. Researchers from Google Threat Intelligence Group and Mandiant confirmed that a threat cluster affiliated with the People’s Republic of China (PRC), tracked as UNC6201, had exploited the vulnerability in real-world attacks. The earliest signs of abuse were traced back to mid-2024.
The Dell RecoverPoint for Virtual Machines vulnerability is tracked as CVE-2026-22769 (CVSS: 10); it is due to the use of hardcoded credentials. A threat actor with knowledge of the credentials could exploit the vulnerability to enable remote access and root-level persistence. Dell has provided a security update as well as a remediation script to mitigate the flaw.
According to the Google report, UNC6201 exploited CVE-2026-22769 in targeted attacks, after initial access had already been gained. While it remains unclear how initial access was achieved, UNC6201 has previously targeted Internet-facing applications, such as VPNs, to gain entry to victim organizations. CVE-2026-22769 was used to "move laterally, maintain persistent access, and deploy malware". In multiple cases, the threat actors compromised VMware virtual infrastructure. Three specific malware variants were identified in attacks (SLAYSTYLE, BRICKSTORM, GRIMBOLT), all of which had backdoor capabilities.
eSentire Threat Intelligence Analysis:
As exploitation is confirmed, organizations need to take rapid action to remediate CVE-2026-22769. The official security update (6.0.3.1 HF1) should be applied, but if this is not immediately possible, a remediation script is available as a temporary solution. These measures will not remove persistence mechanisms that were established following exploitation, as such, organizations should review any potentially impacted devices for signs of compromise.
Public information on UNC6201 is limited at this time, but Google notes that the activity overlaps with UNC5221. The UNC5221 cluster has been associated with Silk Typhoon (aka Hafnium), although Google tracks these threat clusters separately. While it is debated whether UNC6201 is a unique threat actor or part of known group, they are highly advanced; this is proven through their exploitation of a zero-day vulnerability for a long period without detection and their creation of custom malware. Despite detection, the eSentire Threat Intelligence Team assesses that it is almost certain UNC6201 will continue activity.
Victim locations and industries have not been publicly shared, but CISA reports that BRICKSTORM malware has been used by a Chinese APT against organizations in the “Government Services and Facilities and Information Technology Sectors”. Silk Typhoon has targeted a wide range of industries for espionage purposes including law-firms, education, defence, think tanks, and NGOs. It is likely that in the recent campaign, UNC6201 targeting was limited and highly selective, to reduce the likelihood that the groups malware and exploits would be publicly identified. Now that this information has been publicized, there is a high probability that UNC6201 will pivot, employing new tools to minimize the risk of identification and attribution.
In response to the disclosure of CVE-2026-22769 and its abuse by UNC6201, eSentire conducted threat hunts for known Indicators of Compromise (IoCs) and malicious behaviours. Existing rules to detect related tools were already in place, and new detections were created in eSentire MDR for Network. Known malicious infrastructure has been blocked via eSentire’s Global Block List. Additional details, recommendations, and eSentire response actions can be found in the February 18th advisory Dell RecoverPoint Vulnerability Exploited for Two Years (CVE-2026-22769).
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
