Back Feeds2.Feedburner

Criminals create business website to sell RAT disguised as RMM tool

Feeds2.Feedburner •Zeljka Zorz • February 20, 2026

A RAT masquerading as legitimate remote monitoring and management (RMM) software is being sold to cybercriminals as a service, Proofpoint researchers recently discovered. The fake RMM tool, called TrustConnect, was being marketed via an LLM-created website parked on trustconnectsoftware[.]com, supposedly belonging to “TrustConnect Software PTY LTD”. “The malware creator uses the domain as the ‘business website’ designed to convince the public (including certificate providers) that the software is a legitimate RMM app, providing fake details … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Criminals Launch RAT-as-a-Service via Fake RMM Vendor Cybercriminals created a fake remote management vendor that sells a remote access trojan (RAT) disguised as legitimate enterprise software for $300 a month. This scheme exploits the growing trend of using remote monitoring and management (RMM) tools for cyberattacks, affecting organizations that may unknowingly purchase the malicious software. Researchers at Proofpoint identified this operation in late January 2026. 7 sources 40

Criminals create business website to sell RAT disguised as RMM tool

The full story

Extracted Entities

Attack Types (1)

Malware (1)