Ukraine Dismantles 94 Fraudulent Call Centers: Defending Your Organization Against Vishing and Investment Scam Operations

---
title: Unauthorized RMM Tool Execution - Vishing Scam Indicator
id: 3f8a2b71-9c4d-4e6a-b1f2-7d5e9a0c8b31
status: experimental
description: Detects execution of consumer remote access tools frequently used in vishing/tech-support scam operations where call center agents direct victims to grant remote access. Fraudulent call centers commonly instruct victims to install AnyDesk, TeamViewer, UltraViewer, or RustDesk.
references:
  - https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\ultraviewer.exe'
      - '\rustdesk.exe'
      - '\supremo.exe'
      - '\aeroadmin.exe'
  selection_userprofile:
    Image|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  condition: selection_img and selection_userprofile
falsepositives:
  - Organizations that legitimately deploy these tools for IT support (whitelist sanctioned deployments and installation paths such as Program Files via managed installer)
level: high
---
title: Portable RMM Tool Install via User-Initiated Download
id: 8c1d4e52-3a7b-4f98-c2d6-1e9b5f7a3d42
status: experimental
description: Detects creation of consumer RMM executables in user-writable directories, consistent with a victim being walked through a download by a fraudulent call center agent during a vishing scam.
references:
  - https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.t1656
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Local\Temp\'
    TargetFilename|endswith:
      - 'anydesk.exe'
      - 'teamviewer_setup.exe'
      - 'teamviewerqs.exe'
      - 'ultraviewer_setup.exe'
      - 'rustdesk.exe'
      - 'supremo.exe'
      - 'aeroadmin.exe'
  condition: selection
falsepositives:
  - End users installing RMM tools for legitimate personal reasons; correlate with helpdesk tickets
level: medium
---
title: Outbound Connection to Consumer RMM Infrastructure
id: 5e2b9f14-6c8a-4d17-a3e5-9f1c4b8d2a67
status: experimental
description: Detects network connections to consumer remote access service domains from endpoints where such tools are not sanctioned. A hallmark of scam operations where a fraudulent call center agent maintains a live session with the victim's machine.
references:
  - https://www.bleepingcomputer.com/news/security/ukraine-shuts-down-94-fraudulent-call-centers-seize-millions-in-cash/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - '.anydesk.com'
      - '.teamviewer.com'
      - '.rustdesk.com'
      - '.ultraviewer.net'
      - '.supremocontrol.com'
      - '.aeroadmin.com'
  condition: selection
falsepositives:
  - Sanctioned IT support tooling; maintain an allowlist of approved RMM domains and hosts
level: medium

let rmmProcesses = dynamic(["anydesk.exe","teamviewer.exe","teamviewerqs.exe","ultraviewer.exe","rustdesk.exe","supremo.exe","aeroadmin.exe"]);
let execEvents = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (rmmProcesses)
| project DeviceId, DeviceName, ProcessTime=TimeGenerated, FileName, FolderPath, InitiatingProcessAccountName;
let netEvents = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (rmmProcesses)
| where RemoteUrl has_any ("anydesk.com","teamviewer.com","rustdesk.com","ultraviewer.net","supremocontrol.com","aeroadmin.com")
| project DeviceId, NetTime=TimeGenerated, RemoteUrl, RemoteIP, InitiatingProcessFileName;
execEvents
| join kind=inner netEvents on DeviceId
| where NetTime between (ProcessTime .. ProcessTime + 2h)
| summarize FirstExecution=min(ProcessTime), Sessions=count(), RemoteEndpoints=make_set(RemoteUrl), RemoteIPs=make_set(RemoteIP) by DeviceName, InitiatingProcessAccountName, FileName
| order by FirstExecution desc;

CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceVendor =~ "Zscaler" or DeviceVendor =~ "Palo Alto Networks" or DeviceVendor =~ "Blue Coat"
| where RequestURL matches regex @"(?i)(invest|trading|crypto|forex|profit|broker)-?[a-z0-9]+\.(com|net|io|online|site)"
| summarize Hits=count(), Users=make_set(SourceUserID), URLs=make_set(RequestURL) by SourceIP
| where Hits > 3
| order by Hits desc;

-- Hunt for scam-staged remote access tools and their active sessions
LET rmm_regex = '(?i)(anydesk|teamviewer|ultraviewer|rustdesk|supremo|aeroadmin)'

LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ rmm_regex OR Exe =~ rmm_regex

LET connections = SELECT Pid, Name, "Raddr" AS RemoteAddress, "Rport" AS RemotePort, Status
FROM netstat()
WHERE Name =~ rmm_regex

SELECT * FROM processes
UNION ALL
SELECT Pid, Name, RemoteAddress AS CommandLine, RemotePort AS Exe, Status AS Username, NULL AS CreateTime FROM connections

# Audit for unauthorized consumer RMM tools commonly staged by scam call centers
$RmmTools = @('AnyDesk','TeamViewer','UltraViewer','RustDesk','Supremo','AeroAdmin')
$Report = @()

# Check installed programs (both hives)
$UninstallPaths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($Path in $UninstallPaths) {
  $Found = Get-ItemProperty $Path -ErrorAction SilentlyContinue |
    Where-Object { $n = $_.DisplayName; $RmmTools | Where-Object { $n -match $_ } }
  foreach ($App in $Found) {
    $Report += [PSCustomObject]@{
      Type='InstalledApp'; Name=$App.DisplayName
      Version=$App.DisplayVersion; Path=$App.InstallLocation; Action='Review/Remove'
    }
  }
}

# Check portable copies in user-writable directories
$SearchPaths = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:TEMP")
foreach ($Dir in $SearchPaths) {
  Get-ChildItem $Dir -Recurse -Include *.exe -ErrorAction SilentlyContinue |
    Where-Object { $f = $_.Name; $RmmTools | Where-Object { $f -match $_ } } |
    ForEach-Object {
      $Report += [PSCustomObject]@{ Type='PortableBinary'; Name=$_.Name
        Version='-'; Path=$_.FullName; Action='Quarantine' }
    }
}

# Block execution via AppLocker policy recommendation output
if ($Report.Count -gt 0) {
  Write-Warning "Unauthorized RMM artifacts found. Review and remove; enforce AppLocker/WDAC publisher rules to block consumer RMM tools."
  $Report | Format-Table -AutoSize
  $Report | Export-Csv "$env:TEMP\RMM_Audit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
} else {
  Write-Output "No unauthorized RMM artifacts detected on $env:COMPUTERNAME."
}