Trend Micro researchers speculate that cyber offenders may be experimenting with AnyDesk as an alternative to TeamViewer, a similar tool that has previously been abused by ransomware - although in that case, it was confirmed that TeamViewer connections were actually used to install the malicious code. Like TeamViewer, AnyDesk is developed in Germany, and the product gives you bidirectional remote access between personal computers running on various operating systems and unidirectional access on the Android and iOS mobile platforms.

The company refers to BLACKHEART as a 'fairly common ransomware, with a routine that encrypts a variety of files that use different extensions as part of its routine.' In this instance, however, RANSOM_BLACKHEART bundles both the legitimate program and the malware together instead of using AnyDesk for propagation.Ī sample of the malware, detected as RANSOM_BLACKHEART, was found to generate a ransom note demanding a modest sum of $50 in bitcoins in exchange for decrypting affected files, Trend Micro reports in a May 1 blog post. Trend Micro researchers are guessing that cyber offenders are likely testing with AnyDesk as an alternative to TeamViewer, a similar tool that has previously been abused by ransomware. TeamViewer, a tool with more than 200 million users, was abused as by a previous ransomware that used the victim’s connections as a distribution method. This isn’t the first time that a malware abused a similar tool.

According to Trend Micro researchers a new ransomware strain called Blackheart drops its payload alongside the perfectly legitimate AnyDesk remote desktop tool, highly likely as a way to evade detection.

Anydesk scams