A wolf in admin clothing.

About this episode

Selena Larson discusses the discovery of TrustConnect, a malware-as-a-service platform disguised as a legitimate RMM tool.

Today we are joined by Selena Larson, Threat Researcher from Proofpoint research team and co-host of Only Malware in the Building, talking about their work on "(Don't) TrustConnect: It's a RAT in an RMM hat." Proofpoint uncovered TrustConnect, a malware-as-a-service platform posing as a legitimate remote monitoring and management (RMM) tool, but actually functioning as a remote access trojan (RAT) sold to cybercriminals for $300/month. The operation used a fake business website, legitimate-looking certificates, and branded installers (like fake Microsoft Teams or Zoom apps) to trick victims, while providing attackers with full remote control, file transfer, and surveillance capabilities. Although parts of its infrastructure were disrupted, the threat actor quickly rebounded with new variants, highlighting both the resilience of the operation and its deep ties to the broader cybercriminal ecosystem abusing RMM tools. The research and executive brief can be found here: (Don't) TrustConnect: It's a RAT in an RMM hat Learn more about your ad choices. Visit megaphone.fm/adchoices

People in this episode

Guest: Selena Larson

Topics covered

• malware
• cybersecurity
• remote access trojan
• malware-as-a-service
• cybercriminal ecosystem

Keywords

• TrustConnect
• malware
• RAT
• RMM
• cybercriminals
• remote control
• file transfer
• surveillance

Mentioned in this episode

Organizations: Proofpoint

Products: Microsoft Teams, Zoom

Books & works: (Don't) TrustConnect: It's a RAT in an RMM hat

More episodes of Research Saturday

• The skills pay the bills. · May 30, 2026 · 24 min
• Ghosted by Grafana · May 23, 2026 · 26 min
• Scam papers served. · May 16, 2026 · 27 min
• The spy who logged me in. · May 9, 2026 · 24 min
• Double-edged threat. · May 2, 2026 · 31 min
• A QRazy clever scam. · April 25, 2026 · 19 min