Project
AnyDesk is a legitimate remote desktop software application used for cross-platform remote access and support, sometimes abused by attackers for persistence.
Researchers published a working exploit on October 8 that gains root on AnyDesk for Linux before a connection is approved. AnyDesk shipped the fix in June as a "crash" bug with no CVE and no advisory.
Reality
An affiliate entered through an MFA-less SonicWall VPN, then used Safe Mode with Networking to kill endpoint controls. The encryptor ran out of virtual memory instead of running.
Perspective Coverage
3 publishersReality
Google Threat Intelligence and Mandiant put the Brazilian crew's route to Pix and STR at password spraying plus a fake IT support call, which means the controls that bite here are RMM allow-listing and out-of-band verification of the help desk.
Reality
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
Huntress reconstructed an INC intrusion from the logs that had survived. The tradecraft it found was ordinary operator work, the kind a name-based indicator list misses, and how the attackers first got in is still an open question.
Reality
Insikt Group counted 215 actively exploited CVEs in six months, up 34% year on year, and describes attackers running them through remote access utilities, package registries and payment flows defenders already permit.
Reality
The joint advisory says the actors never installed the clients. Portable copies ran in the user's context, pointed at attacker-run RMM servers, and installation controls never saw them.
Reality
Unattended remote access to a Linux desktop is no longer an install step. On Wayland it is a decision about display managers, greeters and which desktop stack you are willing to run.
Reality
Recorded Future says one PurpleDelta cluster applied at more than 1,100 companies and was likely employed at ten or more. The control point is the recruiting funnel, not the SOC.
Reality