{"id":24442,"date":"2026-05-19T11:34:09","date_gmt":"2026-05-19T04:34:09","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24442"},"modified":"2026-06-23T14:14:28","modified_gmt":"2026-06-23T07:14:28","slug":"when-microsoft-teams-is-no-longer-teams-the-truth-behind-the-trojanized-rustdesk-version","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/when-microsoft-teams-is-no-longer-teams-the-truth-behind-the-trojanized-rustdesk-version\/","title":{"rendered":"When Microsoft Teams is no longer Teams: The truth behind the trojanized RustDesk version"},"content":{"rendered":"

Overview<\/span><\/h2>\n

A sophisticated attack campaign was recently discovered, where the attacker distributes a fake Microsoft Teams installer (MSTeamsSetup.exe) to secretly introduce a trojanized version of RustDesk into the system.<\/span><\/p>\n

What makes this campaign particularly dangerous is that the malicious file is signed with a valid digital signature under the name “Zlatin Stamatov.” This “disguise” allows the malware to easily bypass common defense mechanisms like AV or EDR, which typically trust digitally signed software.<\/span><\/p>\n

\"Malware<\/a><\/span><\/p>\n

Hidden behind the scenes is a command and control (C2) infrastructure with many signs matching previous activities of the “calipology” group, known for the Striker C2 framework. Instead of developing malware from scratch, the attacker chooses a “smarter” path: exploiting a legitimate tool like RustDesk, but silently reconfiguring it to automatically connect to their server as soon as it’s installed.<\/span><\/p>\n

Event timeline<\/span><\/h2>\n

The campaign demonstrates long-term infrastructure preparation before actual deployment:<\/span><\/p>\n\n\n\n\n\n\n\n\n
Event timeline<\/span><\/th>\nEvent<\/span><\/th>\nDetails<\/span><\/th>\n<\/tr>\n<\/thead>\n
07\/05\/2025<\/strong><\/span><\/td>\nDomain Registration<\/span><\/td>\nsystemautoupdater[.]com was registered through GoDaddy.<\/span><\/td>\n<\/tr>\n
01\/06\/2025<\/strong><\/span><\/td>\nDNS configuration<\/span><\/td>\nUpdate the DNS records, setting up the infrastructure to remain hidden for nearly a year.<\/span><\/td>\n<\/tr>\n
14\/03\/2026<\/strong><\/span><\/td>\nCertificate Issuance<\/span><\/td>\nDigital signature issued to “Zlatin Stamatov” (Certum Code Signing).<\/span><\/td>\n<\/tr>\n
09\/04\/2026<\/strong><\/span><\/td>\nDetection<\/span><\/td>\nThe first malware samples appeared on MalwareBazaar and CAPE Sandbox.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Main impact<\/span><\/h2>\n

The danger level of this attack chain doesn’t lie in using overly complex techniques, but in its ability to “bypass” the current defense systems of businesses.<\/span><\/p>\n

Bypassing EDR due to being “pre-approved” (whitelisted): The attacker exploits remote desktop software like RustDesk, AnyDesk, or TeamViewer. These are legitimate tools often pre-approved by companies. Therefore, when malware is hidden within these programs, security systems (EDR, Antivirus) overlook them, failing to conduct thorough checks, leaving the SOC team almost blind to any anomalies.<\/span><\/p>\n

Staying hidden on the victim’s machine for a long time: Unlike typical viruses that easily cause errors or slow down the computer, the modified version of RustDesk continues to function normally. Users might even believe they installed it at the IT department’s request. This allows the attacker to remain undetected in the system for weeks or months without raising suspicion.<\/span><\/p>\n

Opening the way for data theft and ransomware: Once they control the machine, hackers can:<\/span><\/p>\n