WhatsApp-borne VBScript silently installs a ManageEngine RMM agent for living-off-the-land remote control
Kaspersky documented (2026-06-22) a globally active campaign distributing heavily obfuscated VBScript via compromised WhatsApp Desktop / Web accounts, with financial-themed document lures in multiple languages (Kaspersky Securelist, 2026-06-22; The Hacker News, 2026-06-23). The three-stage chain: a stage-1 VBScript creates working directories and fetches payloads via curl/bitsadmin/certutil/PowerShell; stage 2 disables UAC consent by writing ConsentPromptBehaviorAdmin=0 to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System and strips Zone.Identifier ADS; stage 3 silently installs a preconfigured ManageEngine Endpoint Central RMM agent via msiexec pointed at attacker-controlled infrastructure. Kaspersky attributes the activity only with low confidence to a Chinese-speaking operator, on the basis of Simplified-Chinese code comments and C2 infrastructure overlapping prior ValleyRAT / Gh0st RAT activity — the claim, not a firm attribution. Victims are concentrated in Malaysia (~80%) with clusters including the UK and Spain.
Why it matters to us: Abuse of a legitimate, signed RMM agent (T1219) is the operational point — there is no bespoke implant to signature, and ManageEngine Endpoint Central is plausibly already whitelisted in many estates. Mapped to T1566.001 (spearphishing attachment, via WhatsApp), T1059.005 (VBScript), T1112 / T1548 (UAC-bypass registry write), T1105 (ingress tool transfer). Detection: msiexec.exe /quiet parented by wscript.exe/cscript.exe; writes to ...\Policies\System\ConsentPromptBehaviorAdmin; certutil -decode or bitsadmin in a script context; and ManageEngine DCAgentService.exe appearing on a host with no corresponding IT-provisioning change ticket. RMM-agent abuse is a well-worn precursor to hands-on-keyboard intrusion and ransomware staging.
the messages contained only the malicious attachment and did not include any accompanying text
Stage 2 modifies UAC registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\ConsentPromptBehaviorAdmin to value 0, disabling consent prompts
ATT&CK mapping
6 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1566.001Phishing: Spearphishing Attachment
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a specific variant of spearphishing. Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email. All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Execution TA0002
T1059.005Command and Scripting Interpreter: Visual Basic
Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.
Persistence TA0003
T1112Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Privilege Escalation TA0004
T1548Abuse Elevation Control Mechanism
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Defense Impairment TA0112
T1112Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
Command and Control TA0011
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.