Attackers Exfiltrate AnyDesk Configuration Data via Blat SMTP in Aerospace Phishing Campaign

Gbhackers •Mayura Kathir • July 7, 2026

A targeted spear-phishing campaign that configures AnyDesk for silent, persistent remote access and exfiltrates its configuration using the Blat SMTP utility. The campaign uses an aerospace-themed invoice lure that impersonates the Russian research institute VNIIR via a freshly registered spoof domain (vniir-avia.space) and delivers a password-protected archive that, when opened, triggers a multi-stage dropper and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Aerospace Phishing Campaign Uses AnyDesk for Remote Access and Data Exfiltration A spear-phishing campaign targets the aerospace sector, impersonating the Russian research institute VNIIR. Attackers use a spoof domain (vniir-avia.space) to deliver a password-protected RAR archive containing a multi-stage dropper. This dropper installs a portable version of AnyDesk configured for silent remote access and exfiltrates sensitive configuration data via the Blat SMTP utility. The phishing emails feature fake invoices to bypass email filters, and the campaign employs living-off-the-land tactics, utilizing legitimate software to evade detection. Persistence is achieved through a scheduled task named 'Auto apdate' that runs at logon. The campaign's sophistication and use of common IT tools make it a significant threat to organizations in the aerospace industry. 4 sources 71

Extracted Entities

Attackers Exfiltrate AnyDesk Configuration Data via Blat SMTP in Aerospace Phishing Campaign

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Domains (1)

MITRE ATT&CK (1)

Tools (2)