In a clever bit of “corporate” rebranding, cybercriminals have launched a professional-looking business website to sell a Remote Access Trojan (RAT) by disguising it as a legitimate Remote Monitoring and Management (RMM) tool.

The Deception

• The “Product”: Marketed as “Tactical RMM” or similar professional sounding names, the software is actually a modified version of the Quasar RAT.
• The Website: The site features polished graphics, fake testimonials, and “enterprise-grade” pricing tiers to trick IT administrators and MSPs into downloading the software.
• Legitimate Cover: By mimicking tools like NinjaOne or ConnectWise, the attackers bypass traditional security filters that often whitelist RMM traffic.

Why It’s Dangerous

• Full Control: Once installed, the RAT gives attackers complete administrative access to the victim’s network, allowing them to steal data or deploy ransomware.
• Persistence: The software is designed to look like a standard background service, making it invisible to the average user.
• Detection Evasion: Security researchers at SentinelOne note that because the “installer” is signed with a valid digital certificate, many antivirus programs initially trust the file.

How to Stay Safe

The Cybersecurity & Infrastructure Security Agency (CISA) recommends:

• Only downloading management software from verified, well-known vendors.
• Checking the domain registration date; many of these “business” sites were created only days before launching the scam.
• Using Application Whitelisting to prevent unauthorized RMM tools from executing on your network.